UTA0560

UTA0560 is a China-linked cyberespionage threat cluster tracked by Volexity, with spear-phishing activity observed since at least March 2026. It has targeted United States-based non-governmental organizations using financial and donation-themed lures. Its phishing links abuse reflected cross-site scripting vulnerabilities on legitimate university websites to redirect recipients to attacker-controlled exploit infrastructure, which selectively targets Google Chrome running on Microsoft Windows. In September 2026, UTA0560 deployed the BlueMoon exploit chain, combining CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to compromise Chrome, escape sandbox restrictions, elevate privileges, and inject code into the browser process. The activity exploited a patch gap between fixes appearing in Chromium source code and their availability in stable Chrome releases. Donation-form decoys concealed exploitation from victims. Subsequent payload delivery used DLL side-loading and scheduled-task persistence before executing GRIMWEDGE, an in-memory JScript backdoor delivered through a Windows Installer package. GRIMWEDGE supports host reconnaissance, file and directory operations, process enumeration and termination, command execution, payload delivery, and file uploads. UTA0560 used byte-for-byte identical core exploit code to JungleBamboo, also known as APT31, but the clusters operated separate infrastructure and deployed different post-exploitation malware. They are tracked as distinct actors; shared exploit code does not establish that they are the same organization or that their operations were coordinated.