Chinese-linked group exploits Chrome and Windows vulnerabilities

Cybersecurity researchers at Volexity have identified a Chinese-linked group, designated as UTA0565, that utilized previously unknown zero-day vulnerabilities in Google Chrome and Microsoft Windows to target Asian government systems.

The campaign, which took place in early September, employed social engineering tactics to gain access. Attackers sent deceptive messages in Chinese and English to government agencies, masquerading as human rights NGOs or independent media outlets. These messages requested support for Hong Kong activist Chow Hang-tung, leading victims to click links that appeared legitimate.

Upon accessing the fraudulent pages, a hidden file was loaded that bypassed browser isolation to grant access to the device. The attackers then installed the CLEANGULP spy program, disguised as a Chrome utility. This malware allowed the group to execute remote commands, list active processes, and exfiltrate sensitive documents to external servers. Both Google and Microsoft have since released patches to address the exploited vulnerabilities.