Loading malware…
CLEANGULP is a Windows backdoor used by the China-linked threat actor UTA0565 in cyberespionage campaigns targeting Asian government entities. Observed deployments on September 3–4, 2026, used targeted Chinese- and English-language phishing emails and fraudulent websites impersonating China Digital Times and the Center for American Progress. The websites delivered the BlueMoon exploit kit, which chained Chrome vulnerabilities CVE-2026-85046 and CVE-2026-87491 with Windows privilege-escalation vulnerability CVE-2026-85880 to compromise systems and install the backdoor.
Written in C and compiled with Microsoft Visual C Compiler, CLEANGULP uses control-flow flattening and indirect calls to hinder analysis. It establishes persistence through a scheduled task and supports shell-command execution, process enumeration, file upload and download, and execution of Beacon Object Files. These functions enable host reconnaissance, data exfiltration, and additional operator-directed activity. Its command-and-control communications use HTTP with AES-256-GCM-encrypted request and response bodies encoded using a custom Base64 alphabet.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
UTA0565 ran fake websites on September 3 and 4, 2026, against Asian government entities to drop CLEANGULP.
UTA0560 — CLEANGULP (alias GRIMWEDGE) : Backdoor JScript modulaire. Chaîne de chargement : msgbox.exe (dropper) → wsc.dll (DLL sideloadée) → fichier MSI malveillant. Persistance via tâche planifiée nommée “Windows Scheduled System”.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
“Each phishing message pointed to a domain controlled by the attackers,” with listed typosquatted domains including chinadigitaltimes[.]top, americanprgoress[.]top, and thecovnresation[.]com.
Persistance via tâche planifiée nommée “Windows Scheduled System”.
CLEANGULP (alias GRIMWEDGE) : Backdoor JScript modulaire ... Capacités : ... exécution de commandes arbitraires.
Trois vulnérabilités critiques ont été enchaînées : CVE-2026-85046 ... Type Confusion ... Chrome V8 ; CVE-2026-87491 ... échappement de sandbox WebAssembly dans Chrome V8.
Launch it via the Windows shell using COM, replacing the cmd.exe/curl command.
Persistance via tâche planifiée nommée “Windows Scheduled System”.
Persistance via tâche planifiée nommée “Windows Scheduled System”.
This HTML element consists of the same components used in previously analyzed exploitation of Chrome ... and Windows local privilege escalation exploits (CVE-2026-85880).
The malware was originally written in C and built using the Microsoft Visual C Compiler, then heavily obfuscated using control flow flattening and indirect calls to hinder analysis.
Installation to %LOCALAPPDATA%\Microsoft\IME\MicrosoftIME.exe ... Persistence through a scheduled task named “MicrosoftIME”.
“Each phishing message pointed to a domain controlled by the attackers that closely copied a legitimate site,” including pages impersonating China Digital Times and the Center for American Progress. CLEANGULP “installs itself under a Microsoft-looking name.”
“The chain downloaded a replacement executable, stripped its Windows internet warning marker, and launched it through Windows shell components.”
CLEANGULP supports the "ps" command "to list running processes."
C2 : cloud.shinewrist[.]net et ocr.opusaccel[.]top.
The final "pp" shellcode downloaded an executable named "chrome_cleanup.exe" from the bogus domain; the downloaded payload was identified as CLEANGULP.
“CLEANGULP communicates over ordinary HTTP with a hardcoded command server, encrypting its messages before sending them.”
CLEANGULP ... Capacités : reconnaissance système, gestion fichiers/processus, exécution de commandes arbitraires, exfiltration de fichiers.
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.