Minacce · 35 giorni fa
Siti fake moltiplicano lo sfruttamento dei zero-day di Chrome e Windows Volexity ha aggiunto un terzo attore cinese, tracciato come UTA0565 , alla campagna che sfrutta i zero-day di Google Chrome e Microsoft Windows. Le nuove attività risalgono al 3-4 settembre, mentre le falle erano ancora senza patch, e cambiano il quadro: lo sfruttamento non è più legato a un solo gruppo o a un singolo vettore.
Il punto nuovo è la distribuzione della consegna. La vittima apre un link che sembra portare a un sito reale di notizie o advocacy, ma la pagina carica di nascosto un elemento invisibile che innesca la catena di exploit dietro le quinte. Così il sito esca fa da esca e da attivatore insieme.
Per chi difende ambienti che si appoggiano a URL filtering o a takedown reattivi, una sola rimozione non chiude il problema: altri siti gemelli e nuove mail di phishing possono tenere viva la campagna. L’esposizione resta quindi distribuita finché restano attivi sia la catena di exploit sia l’infrastruttura di lure.
NVD KEV
Sfruttamento noto · CISA KEV
CVSS 8.8 HIGH: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Patch Microsoft: Release Notes.
Data di correzione federale CISA 18 set · data superata
NVD KEV
Sfruttamento noto · CISA KEV
CVSS 7.8 HIGH: heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. Patch Microsoft: 5122876.
Patch disponibile KB5122876 Scarica →
Data di correzione federale CISA 22 set · data superata
NVD KEV
Sfruttamento noto · CISA KEV
Patch Microsoft: Release Notes.
Data di correzione federale CISA 23 set
Cronologia Fonti 16 fonti che coprono questa storia
BleepingComputer 23 set
InfraTrust report warns network management systems under attack
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them.
The Hacker News 23 set
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.
CyberScoop 22 set
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups.
Volexity 22 set
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors.
INCIBE-CERT 15 set
Múltiples vulnerabilidades en productos de Cisco
Cisco ha publicado 6 vulnerabilidades: 5 de severidad crítica y una de severidad alta que, en caso de
The Hacker News 15 set
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.
Dark Reading 15 set
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022.
Rapid7 11 set
Metasploit Wrap-Up Goes to Sixteen
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
BleepingComputer 10 set
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.
The Register Security 10 set
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Mind the patch gap, please and thank you
Proofpoint 9 set
Four groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.
CyberScoop 9 set
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Multiple China-aligned threat groups exploited the defects quickly to target various organizations. Proofpoint said the activity is ongoing and expects it to widen.
Entità CVE-2026-85046 CVE-2026-85880 CVE-2026-87491 UTA0565 Riepilogo fornitore: Microsoft
Part of the PlainSec briefing for 2026-09-09
Editions Storie correlate Minacce · 35 giorni fa
Siti fake moltiplicano lo sfruttamento dei zero-day di Chrome e Windows Volexity ha aggiunto un terzo attore cinese, tracciato come UTA0565 , alla campagna che sfrutta i zero-day di Google Chrome e Microsoft Windows. Le nuove attività risalgono al 3-4 settembre, mentre le falle erano ancora senza patch, e cambiano il quadro: lo sfruttamento non è più legato a un solo gruppo o a un singolo vettore.
Il punto nuovo è la distribuzione della consegna. La vittima apre un link che sembra portare a un sito reale di notizie o advocacy, ma la pagina carica di nascosto un elemento invisibile che innesca la catena di exploit dietro le quinte. Così il sito esca fa da esca e da attivatore insieme.
Per chi difende ambienti che si appoggiano a URL filtering o a takedown reattivi, una sola rimozione non chiude il problema: altri siti gemelli e nuove mail di phishing possono tenere viva la campagna. L’esposizione resta quindi distribuita finché restano attivi sia la catena di exploit sia l’infrastruttura di lure.
NVD KEV
Sfruttamento noto · CISA KEV
CVSS 8.8 HIGH: type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Patch Microsoft: Release Notes.
Data di correzione federale CISA 18 set · data superata
NVD KEV
Sfruttamento noto · CISA KEV
CVSS 7.8 HIGH: heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally. Patch Microsoft: 5122876.
Patch disponibile KB5122876 Scarica →
Data di correzione federale CISA 22 set · data superata
NVD KEV
Sfruttamento noto · CISA KEV
Patch Microsoft: Release Notes.
Data di correzione federale CISA 23 set
Cronologia Fonti 16 fonti che coprono questa storia
BleepingComputer 23 set
InfraTrust report warns network management systems under attack
Attackers are increasingly targeting the management systems used to control enterprise infrastructure, with several critical vulnerabilities actively exploited before or shortly after vendors disclosed them.
The Hacker News 23 set
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
UTA0565 exploited a Chrome-Windows zero-day chain through fake websites to deploy CLEANGULP malware against Asian government entities.
CyberScoop 22 set
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups.
Volexity 22 set
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome (CVE-2026-85046, CVE-2026-87491) and Microsoft Windows (CVE-2026-85880) by two different Chinese advanced persistent threat (APT) actors.
INCIBE-CERT 15 set
Múltiples vulnerabilidades en productos de Cisco
Cisco ha publicado 6 vulnerabilidades: 5 de severidad crítica y una de severidad alta que, en caso de
The Hacker News 15 set
China-Linked Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy GRIMWEDGE
UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.
Dark Reading 15 set
'Sandworm' Chains Cisco Vulnerabilities to Deploy Cyclops Blink
The notorious Russian threat group is spreading an upgraded version of the botnet malware, which the FBI disrupted in 2022.
Rapid7 11 set
Metasploit Wrap-Up Goes to Sixteen
Another banger from Metasploit with sixteen new modules, including ten exploit modules, with five on the CISA KEV list. Cisco, Papercut, Sonicwall, Jetbrains, and Langflow all have exploit modules, and not to be outdone, we even have a Metasploit scanner to watch the watchers!
BleepingComputer 10 set
CISA: WatchGuard RCE flaw now exploited in ransomware attacks
Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that ransomware gangs are also exploiting a critical WatchGuard Firebox firewall vulnerability, which it flagged as actively exploited in December.
The Register Security 10 set
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Mind the patch gap, please and thank you
Proofpoint 9 set
Four groups caught using the same Chrome and Windows exploit kit
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.
CyberScoop 9 set
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Multiple China-aligned threat groups exploited the defects quickly to target various organizations. Proofpoint said the activity is ongoing and expects it to widen.
Entità CVE-2026-85046 CVE-2026-85880 CVE-2026-87491 UTA0565 Riepilogo fornitore: Microsoft
Part of the PlainSec briefing for 2026-09-09
Editions Storie correlate