Loading malware…
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
On September 1, 2026, a cluster Volexity tracks as UTA0560 phished US-based non-governmental organizations (NGOs) to deliver the GRIMWEDGE JScript backdoor.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
The activity begins with a spear-phishing email that persuades a recipient into clicking an embedded link pointing to a legitimate website susceptible to a reflective XSS vulnerability.
Persistance via tâche planifiée nommée “Windows Scheduled System”.
CLEANGULP (alias GRIMWEDGE) : Backdoor JScript modulaire ... Capacités : ... exécution de commandes arbitraires.
The browser-process injection stub executes: cmd.exe /c curl ... && "%TEMP%\msgbox.exe".
“UTA0560 used its access to drop a custom loader chain ending in GRIMWEDGE, a JScript backdoor running entirely in memory inside msiexec.exe.”
Trois vulnérabilités critiques ont été enchaînées : CVE-2026-85046 ... Type Confusion ... Chrome V8 ; CVE-2026-87491 ... échappement de sandbox WebAssembly dans Chrome V8.
Persistance via tâche planifiée nommée “Windows Scheduled System”.
Persistance via tâche planifiée nommée “Windows Scheduled System”.
The final exploit payload is shellcode to perform browser process injection and payload download; CVE-2026-85880 is used to inject code into the Chrome browser process.
The p2 payload is shellcode that reflectively loads a DLL to facilitate Windows kernel privilege escalation.
The final exploit payload is shellcode to perform browser process injection and payload download; CVE-2026-85880 is used to inject code into the Chrome browser process.
When a payload is received, wsc.dll writes it to %TEMP%\Temp.txt and executes it via msiexec /i.
“GRIMWEDGE, a JScript backdoor running entirely in memory inside msiexec.exe.”
GRIMWEDGE supports the Tasklist command to enumerate running processes.
GRIMWEDGE supports the Info command to perform system reconnaissance, and the initial payload conducts host reconnaissance and fingerprinting.
GRIMWEDGE supports Dir to fetch a directory listing and Type to read a file up to 5 MB.
GRIMWEDGE can read files up to 5 MB, while LONGTALE collects cookies, storage tokens, navigation history, keystrokes, and session metadata.
C2 : cloud.shinewrist[.]net et ocr.opusaccel[.]top.
“GRIMWEDGE JScript backdoor [provides] ... payload delivery capabilities.”
CLEANGULP ... Capacités : reconnaissance système, gestion fichiers/processus, exécution de commandes arbitraires, exfiltration de fichiers.
GRIMWEDGE supports Taskkill to kill a process by PID.
19 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.