Date: 09/21/2026
Severity: High
Summary
Chinese threat actors UTA0560 and JungleBamboo (APT31) exploited a Chrome patch-gap vulnerability, CVE-2026-85046, in targeted spear-phishing campaigns against NGOs. The exploit chain combined CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (V8 sandbox escape), and CVE-2026-85880 (Windows kernel LPE) to escape browser and OS security boundaries. UTA0560 deployed the GRIMWEDGE JScript backdoor, while JungleBamboo delivered SUPERSTOMP, which installed the LONGTALE credential-stealing Chrome extension.
Indicators of Compromise (IOC) List
Domains/URLs | cloud.shinewrist.net ocr.opusaccel.top msbenefit.com gitprogram.com https://photos.msbenefit.com/fa/t3 https://proof.gitprogram.com/a4/j8 https://xyz0102.gitprogram.com/a001 |
IP Address | 206.166.251.164 |
Hash | d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b
337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d
7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c
cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0
b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1
5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6
51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc
69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc
3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f
56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951
59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb
e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0
5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "https://proof.gitprogram.com/a4/j8" or url like "https://proof.gitprogram.com/a4/j8" or siteurl like "https://proof.gitprogram.com/a4/j8" or domainname like "cloud.shinewrist.net" or url like "cloud.shinewrist.net" or siteurl like "cloud.shinewrist.net" or domainname like "gitprogram.com" or url like "gitprogram.com" or siteurl like "gitprogram.com" or domainname like "ocr.opusaccel.top" or url like "ocr.opusaccel.top" or siteurl like "ocr.opusaccel.top" or domainname like "msbenefit.com" or url like "msbenefit.com" or siteurl like "msbenefit.com" or domainname like "https://photos.msbenefit.com/fa/t3" or url like "https://photos.msbenefit.com/fa/t3" or siteurl like "https://photos.msbenefit.com/fa/t3" or domainname like "https://xyz0102.gitprogram.com/a001" or url like "https://xyz0102.gitprogram.com/a001" or siteurl like "https://xyz0102.gitprogram.com/a001" |
Detection Query 2 : | dstipaddress IN ("206.166.251.164") or srcipaddress IN ("206.166.251.164") |
Detection Query 3 : | sha256hash IN ("d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b","337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d","7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c","cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0","b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1","5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6","51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc","69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc","3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f","56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951","59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb","e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0","5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3")
|
Reference:
https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/