UTA0560

UTA0560 is a China-linked threat cluster that has conducted spear-phishing operations against nongovernmental organizations since at least March 2026. Its campaigns use donation and financial-themed lures and have abused reflected cross-site-scripting flaws on legitimate websites to redirect targets to browser exploit infrastructure. In September 2026, UTA0560 used a Chrome-on-Windows exploit chain incorporating CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to obtain execution outside the browser sandbox and elevate privileges. The actor used environment filtering, Web Worker-based exploitation, retry logic, host and process-token reconnaissance, Chrome process injection, DLL sideloading, scheduled-task persistence, and obfuscated JScript execution. UTA0560 deployed GRIMWEDGE, an in-memory JScript backdoor supporting system, process, and file discovery; file management; command execution; payload delivery; and staged file upload. UTA0560 is distinct from JungleBamboo, although both clusters used byte-identical core exploit shellcode during contemporaneous 2026 campaigns and delivered separate post-exploitation payloads.