Chinese actors hit Chrome and Windows with dual zero-days, deploying malware via unpatched flaws
Volexity details how threat actors linked to China exploited unpatched flaws in browser and OS software to deploy malware payloads.
Key points
- Chinese threat actors used simultaneous zero-day exploits in Google Chrome and Microsoft Windows.
- Volexity researchers reconstructed the attack chain using Volcano forensic tools and AI assistance.
- The campaign aimed to download and execute malware on compromised endpoints within enterprise networks.
Volexity published findings last month revealing that multiple Chinese threat actors deployed zero-day exploits against Google Chrome and Microsoft Windows. According to the security firm’s analysis, these actors operated simultaneously to breach systems and install malicious software on targeted endpoints.
Volexity researchers demonstrated the exploit chain by compromising a virtual machine with the same payloads used by UTA0560. The attackers attempted to cover their tracks once they realized the environment was monitored, but forensic tools captured the activity. This reconstruction allowed analysts to analyze the related artifacts.
Forensic reconstruction methods
Volexity used its Volcano platform to analyze the breach. The tool integrates with Cyber Threat Intelligence feeds and a new Model Context Protocol server for AI-assisted investigations. Researchers used Surge Collect Pro to capture memory, registry hives, event logs, and other artifacts from the compromised system.
Volcano’s built-in indicators identified memory-only components, including reflectively loaded DLLs and shellcode within the Chrome process. The system also flagged persistence mechanisms and invalid parent-child process relationships. Threat Intel feeds provided real-time lookups that detected the malicious hostname cloud.shinewrist[.]net in command lines and logs.
Affected environments and scope
The exploits target widely used software components, making any organization running unpatched versions of Chrome or Windows potentially vulnerable. Volexity Volcano provides rapid response capabilities across Windows, Linux, and macOS endpoints at enterprise scale. The findings stem from an active investigation into Chinese-linked threat activity.
Defender's checklist
Organizations should verify the patch status of all Chrome and Windows installations immediately. Security teams need to review event logs for connections to known malicious hostnames. Analysts should check for unusual process relationships and memory-only modules that do not correspond to standard application behavior.
Operational impact
When zero-day exploits are identified, operations leaders should prioritize confirming the software versions running across their infrastructure. Teams usually begin by isolating systems that show signs of the specific exploit chain to prevent lateral movement. Management needs to determine which suppliers or partners might share similar vulnerable environments. Internal communications should clarify who holds authority for emergency patching decisions and how to verify system integrity without disrupting critical business functions.
Background: Malware
Malware operates through four distinct phases: delivery, execution, installation, and action. Each phase requires specific system permissions or user interaction to proceed. By identifying the exact mechanism used in each stage, you can implement targeted controls that interrupt the chain before the malicious code achieves its objective.
Read the full guide: How Malware Works: The 4 Stages of Infection
What to do and how to stay safe: Volexity
- Audit all endpoints for the specific versions of Chrome and Windows mentioned in the vulnerability disclosures.
- Monitor network traffic for connections to domains associated with the threat actor infrastructure.
- Review system logs for indicators of privilege escalation or unauthorized persistence mechanisms.
- Ensure forensic data collection tools are ready to capture memory and registry states if a breach is suspected.
Step-by-step guide: Patch Management vs Vulnerability Management: The Critical Distinction
General security guidance from the InfoSec Ledger newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which threat actor was responsible for this campaign?
Volexity attributes the activity to multiple Chinese threat actors, including the group known as UTA0560.
What software was exploited?
The attackers used zero-day vulnerabilities in Google Chrome and Microsoft Windows to gain access.
Is a patch available for these flaws?
The source material does not confirm the availability of a patch or fix for these specific zero-day exploits.
