China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE Backdoor

Security researchers identified a threat cluster tracked as UTA0560 exploiting the multi-stage vulnerability chain to escape Chrome's security boundaries, elevate privileges on Windows systems and ultimately deploy a previously undocumented JavaScript backdoor known as GRIMWEDGE.

The activity was detected on September 1, 2026, when targeted organizations received spear-phishing emails designed to redirect victims through a compromised legitimate website before triggering the browser exploit chain.

Three Vulnerabilities Combined Into One Attack

The exploit framework, known as BlueMoon, combines three vulnerabilities affecting Chrome's V8 JavaScript engine and Windows Advanced Local Procedure Call (ALPC).

Rather than relying on a single vulnerability, the attackers combined browser exploitation, sandbox escape and Windows privilege escalation to move from visiting a malicious webpage to executing malware on the underlying operating system.

All three vulnerabilities have since been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog.

Attack Begins With Spear-Phishing

UTA0560 targeted multiple NGOs using carefully crafted spear-phishing emails.

The messages encouraged recipients to click a link pointing to the website of a legitimate U.S.-based university.

Instead of directly sending victims to an obviously malicious domain, the attackers abused a reflected cross-site scripting vulnerability on the legitimate website to redirect visitors toward infrastructure controlled by the threat actor.

The attack infrastructure also checked whether visitors were using Google Chrome on Windows, helping the attackers avoid wasting the valuable exploit chain on incompatible systems.

The attack sequence can be summarized as:

Spear-phishing email
↓
Legitimate university website
↓
Reflected XSS abused for redirection
↓
Attacker-controlled exploit page
↓
CVE-2026-85046 – V8 exploitation
↓
CVE-2026-87491 – Chrome sandbox escape
↓
CVE-2026-85880 – Windows privilege escalation
↓
Chrome process injection
↓
Malware downloaded and executed
↓
GRIMWEDGE deployed

This approach combines social engineering with several security vulnerabilities, allowing the attacker to transition from a malicious web page to persistent malware execution.

BlueMoon Uses a Multi-Stage Payload

Researchers found three Base64-encoded binary payloads embedded within JavaScript on the final exploit page.

The first stage performs host reconnaissance and fingerprints the Windows environment.

A second component handles Windows kernel privilege escalation.

The final shellcode injects code into the Chrome browser process and downloads the next-stage malware.

This modular architecture allows the exploit developer to separate browser exploitation, privilege escalation and payload delivery into distinct stages.

GRIMWEDGE Delivered Through DLL Sideloading

Following successful exploitation, UTA0560 downloads an executable named:

msgbox.exe

The loader extracts a legitimate Windows executable together with a malicious DLL called:

wsc.dll

The attackers then use DLL sideloading, causing the legitimate executable to load the malicious library.

The DLL establishes persistence through a scheduled task called:

Windows Scheduled System

The task repeatedly executes the malware chain, helping maintain access to the compromised machine.

The malware also contacts attacker-controlled infrastructure using the infected computer's hostname, allowing the operators to provide victim-specific payloads.

GRIMWEDGE Provides Remote Control

The final payload is a compact JavaScript-based backdoor tracked as GRIMWEDGE.

Despite its relatively small size, the malware gives attackers several capabilities for remotely controlling an infected computer.

These include:

• System reconnaissance
• Directory enumeration
• Directory creation
• File deletion
• File reading
• Process enumeration
• Process termination
• Command execution
• File uploads
• Additional payload delivery

GRIMWEDGE operates largely in memory and provides the attackers with a lightweight foothold from which additional espionage tools can be deployed.

Researchers observed the malware sending information including the victim's domain, username and previous command output to its command-and-control infrastructure.

APT31 Uses the Same Exploit Chain

The investigation became more significant when researchers discovered another China-linked threat actor using essentially the same Chrome-Windows exploit chain at approximately the same time.

The second group is tracked as JungleBamboo, better known as APT31 and also associated with names including Violet Typhoon and TA412.

APT31 did not deploy GRIMWEDGE.

Instead, the group used a loader known as SUPERSTOMP to install a malicious Chrome extension called LONGTALE, also tracked as GemStone.

The malicious extension masqueraded as a Google Gemini extension and was designed for browser surveillance and credential theft.

This distinction is important:

Researchers found identical underlying exploit components but different infrastructure and post-exploitation malware.

BlueMoon Was Used by Multiple Espionage Groups

Separate research found that BlueMoon spread beyond these two operations remarkably quickly.

Proofpoint observed at least four espionage-focused threat clusters using the exploit kit within approximately one week.

Targets included organizations in sectors such as:

• Government
• NGOs
• Aerospace
• Mining
• Commodity trading
• Manufacturing
• Consulting
• Financial services

Most of the identified activity had a suspected China nexus, although researchers cautioned that some BlueMoon usage remained unattributed.

The rapid adoption raises the possibility that the exploit framework was shared, sold or otherwise made available to multiple operators.

The "Patch Gap" Created an Opportunity

Another important aspect of BlueMoon is how the attackers may have obtained the Chrome vulnerabilities.

Researchers described the Chrome bugs as patch-gap zero-days.

The underlying vulnerabilities had already been fixed within publicly accessible upstream Chromium source code, but those fixes had not yet reached stable Chrome releases being used by ordinary users.

That created a temporary window where attackers could potentially examine Chromium changes, identify the security flaw and develop an exploit before downstream browsers shipped the patch.

This is particularly significant for large open-source projects where security-related code changes may become visible before downstream products distribute updates.

What Security Teams Should Hunt For

Installing security updates prevents new exploitation through these vulnerabilities, but it does not automatically remove malware already installed on compromised systems.

Organizations that may have been targeted should therefore investigate endpoints rather than relying exclusively on patch status.

One particularly suspicious process sequence identified in reporting is:

chrome.exe → cmd.exe → curl.exe → downloaded executable

Security teams should also investigate unexpected executables such as msgbox.exe or ChromeUpdate.exe appearing within temporary directories.

Other useful areas for investigation include:

• Chrome spawning command shells or download utilities
• Unexpected DLL sideloading
• Suspicious scheduled tasks
• Newly installed Chrome extensions
• Unknown extensions masquerading as legitimate Google products
• Unusual outbound connections from msiexec.exe
• Browser processes exhibiting code-injection behavior
• Unexpected executables inside %TEMP%
• Recently created persistence mechanisms

For GRIMWEDGE specifically, defenders should look for the scheduled task named Windows Scheduled System associated with the malware's persistence mechanism.

Organizations Should Patch Chrome and Windows Immediately

Google patched CVE-2026-85046 in Chrome 152.0.7977.82/.83 for Windows and macOS, while Microsoft addressed the Windows vulnerability through its September security updates. Google subsequently released a fix for the second V8 vulnerability involved in the BlueMoon chain.

Organizations should:

• Update Google Chrome and other Chromium-based browsers immediately.
• Apply Microsoft's latest Windows security updates.
• Restart browsers after updates to ensure patched versions are running.
• Audit installed Chrome extensions.
• Hunt for suspicious scheduled tasks and DLL sideloading.
• Investigate unusual Chrome child-process activity.
• Review phishing telemetry for links involving legitimate websites acting as redirectors.
• Isolate systems showing evidence of exploitation.
• Conduct endpoint and memory analysis when browser-process injection is suspected.

Because BlueMoon has already been used by multiple threat clusters, organizations should treat evidence of exploitation as a potential full endpoint compromise, not simply a browser-security incident.

Security Takeaway

The BlueMoon campaign demonstrates how rapidly sophisticated browser exploitation capabilities can move between threat actors.

UTA0560 combined spear-phishing, abuse of a legitimate website, two Chrome vulnerabilities and a Windows privilege-escalation flaw to move from a single browser click to deployment of the GRIMWEDGE espionage backdoor.

The discovery that APT31 and several other espionage groups gained access to the same exploit framework within days is equally significant.

Historically, reliable browser sandbox-escape and operating-system exploitation chains have represented expensive and relatively scarce offensive capabilities. The rapid distribution of BlueMoon suggests that these capabilities may be becoming easier to develop, acquire or share.

For defenders, patching remains essential—but patching alone is insufficient once exploitation has occurred. Security teams should combine rapid browser and operating-system updates with endpoint threat hunting, browser-extension monitoring and investigation of unusual activity originating from browser processes.

SEO Meta Description:
China-linked hackers chained Chrome and Windows zero-days using the BlueMoon exploit kit to deploy GRIMWEDGE, steal credentials and compromise targeted organizations.