[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fM5E-VTmfTZh4ixFsPlFbw_wI4hezDpETI0dirzPMQ2s":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"e8b77bab-d187-41d3-8062-9d64a926b0d5","Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects","volexity-spots-another-china-aligned-threat-group-exploiting-chrome-and-microsof-a89c8f","The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups. The post Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects appeared first on CyberScoop.","Volexity has identified a China-aligned threat group, UTA0565, exploiting a chain of three zero-day vulnerabilities in Chrome and Windows. These exploits were used in early September, prior to public disclosure and patching. UTA0565's tactics, including the use of fake websites and phishing emails targeting Asian government entities, show sophistication and a shared exploit kit component observed across multiple Chinese threat groups, suggesting potential coordination within the Chinese cyber espionage community.","China-aligned UTA0565 group exploits Chrome and Windows zero-days using shared exploit kit.","https:\u002F\u002Fcyberscoop.com\u002Fvolexity-uta0565-china-exploit-chain-chrome-microsoft\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F04\u002FGettyImages-1332529886.jpg","2026-09-22T18:47:07+00:00","2026-09-22T20:00:04.161031+00:00",9,[17,20,22,25,27],{"name":18,"type":19},"UTA0565","threat_actor",{"name":21,"type":19},"APT31",{"name":23,"type":24},"Chrome","product",{"name":26,"type":24},"Windows",{"name":28,"type":29},"Microsoft","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60],{"type":55,"value":56,"context":57},"cve","CVE-2026-85046","Remote code execution vulnerability in Chromium JavaScript engine",{"type":55,"value":59,"context":57},"CVE-2026-87491",{"type":55,"value":61,"context":62},"CVE-2026-85880","Privilege escalation vulnerability in Windows ALPC",[28,23,26],{"controls":65,"vendors":151},[66,95,123],{"slug":67,"name":68,"problem":69,"products":70},"patch-management","Automated patch management","Known holes get closed in days, not months.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,115],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":109,"vendor_name":28,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":52,"name":124,"problem":125,"products":126},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[127,135,143],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[152,155],{"slug":128,"name":129,"logo_path":130,"roles":153},[154],"affected",{"slug":109,"name":28,"logo_path":110,"roles":156},[154],{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":174},"china-aligned-group-exploits-chrome-windows-zero-days-before-patches-available","China-Aligned Group Exploits Chrome & Windows Zero-Days Before Patches Available","UTA0565 leveraged a chain of three zero-day vulnerabilities in Chrome and Windows to compromise Asian government entities before any patches were publicly available, highlighting the severe risk posed by nation-state actors with access to undisclosed exploits. The use of fake websites and phishing emails as delivery mechanisms demonstrates that even sophisticated zero-day attacks rely on human interaction as an entry point. The apparent sharing of exploit kits across multiple Chinese threat groups suggests a coordinated ecosystem of offensive cyber tools, raising the stakes for defenders who may face the same exploit from multiple actors simultaneously. This incident underscores that zero-day exposure windows — however brief — can be catastrophically leveraged by well-resourced adversaries, making layered defenses and rapid patch deployment essential even when vulnerabilities are newly disclosed.",[162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 17: Incident Response Management","NIST SP 800-40: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST RA-5: Vulnerability Scanning","NIST IR-4: Incident Handling","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1566: Phishing","ISO 27001 A.12.6.1: Management of Technical Vulnerabilities","CISA KEV: Known Exploited Vulnerabilities Catalog Monitoring",{}]