Loading threat actor…
UTA0565 is a China-linked, state-aligned cyberespionage actor tracked by Volexity that targets Asian government entities. Campaigns observed on September 3–4, 2026 used Chinese- and English-language phishing emails and cloned websites impersonating China Digital Times and the Center for American Progress. Lures included appeals supporting imprisoned Hong Kong activist Chow Hang-tung, while legitimate website content served as decoy material. The actor used the BlueMoon exploit kit to chain Chrome vulnerabilities CVE-2026-85046 and CVE-2026-87491 with Windows Advanced Local Procedure Call vulnerability CVE-2026-85880 while the flaws remained unpatched. The chain enabled browser sandbox escape, code execution, and privilege escalation. Concealed website frames loaded the exploitation components, and the payload-delivery sequence removed Mark of the Web before launching the malware through Windows shell components. UTA0565 deployed CLEANGULP, a Windows backdoor that establishes scheduled-task persistence and supports shell-command execution, process enumeration, file upload and download, and Beacon Object File execution. CLEANGULP uses control-flow obfuscation and encrypted command-and-control messages transmitted over HTTP. Its exploit framework shares core components with those used by other Chinese espionage actors, while UTA0565 customized payload delivery and phishing-page presentation.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
3 CVEs Mallory has associated with this actor across public reporting. 3 of them are exploited in the wild (not necessarily by this actor).
16 indicators attributed to this actor. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.