A Coordinated Zero-Day Attack Hits in Early September

Security researchers at Volexity have linked a threat actor known as UTA0565 to a wave of attacks that took place on September 3 and 4. According to Volexity's findings, the group chained together three separate zero-day vulnerabilities, two in Google Chrome and one in Windows, to compromise targets through spoofed websites designed to look legitimate. The end goal of the operation was to deploy a piece of malware researchers have named CLEANGULP.

Zero-days, vulnerabilities that are exploited before a vendor has issued a patch, are among the most dangerous tools in an attacker's arsenal because there is no fix available at the time of the attack. Chaining three of them together, spanning both a browser and an operating system, suggests a well-resourced and technically sophisticated actor. This is not a smash-and-grab campaign; it reflects careful planning and access to exploit development capability that is typically expensive to acquire or build.

How CLEANGULP Gets In and Stays In

Based on Volexity's reporting, the attack chain begins with a spoofed site that a victim is lured into visiting. Once there, the Chrome zero-days are used to gain initial code execution inside the browser, and the Windows zero-day is then used to escalate that access and break out of the browser's normal security boundaries. From there, CLEANGULP is installed on the victim's machine.

Defenders reviewing Volexity's indicators of compromise now have visibility into how CLEANGULP establishes persistence on infected systems, along with the specific files it drops and the command-and-control (C2) infrastructure it communicates with. For security teams, these details matter because they turn an abstract threat into something they can actually search for in logs, endpoint telemetry, and network traffic. Hunting guides like this one are valuable precisely because they let organizations check whether they were already touched by the campaign, rather than waiting to find out after the fact.

This pattern, where a single compromised entry point is used to escalate privileges and drop a custom malware payload, is becoming a recurring theme across recent zero-day disclosures. Similar escalation tactics were seen when SonicWall SMA zero-days were exploited to deploy custom malware, and again when UTA0533 hackers exploited SonicWall SMA zero-days to gain a foothold in enterprise networks. Attackers increasingly favor chained exploitation because it lets them bypass layered defenses that were designed to stop a single point of failure.

Why This Matters Beyond the Enterprise

It is tempting to treat a browser-and-OS zero-day chain as purely an enterprise security problem, but the reality is broader. Chrome is one of the most widely used browsers in the world, and Windows remains the dominant desktop operating system for both businesses and individuals. A spoofed website campaign does not require a victim to work at a specific company; it simply requires someone, anywhere, to click a malicious link. That makes this type of attack a privacy concern for everyday users as well as a security concern for IT departments.

Once CLEANGULP is installed, an attacker with persistence on a device can potentially access personal files, browsing history, saved credentials, and communications, depending on what the malware is designed to collect. Even users who never interact directly with the organizations initially targeted by UTA0565 could be affected if they visit a spoofed site set up as part of the same infrastructure. This is consistent with a broader trend of zero-day exploitation reaching beyond the original target list, a pattern also visible in incidents like the Check Point SmartConsole zero-day exploited in attacks and the extended exposure window seen in the SonicWall SMA 1000 zero-day used by INC ransomware over 22 days.

What This Means For You

Most readers will not be direct targets of a nation-state-level operation like UTA0565's, but the underlying lesson applies broadly: keep your browser and operating system updated. Chrome and Windows both push security patches regularly, and once a zero-day becomes public knowledge, as this one now has through Volexity's disclosure, vendors typically move quickly to patch it. Delaying updates leaves you exposed during exactly the window when attackers know the flaw exists and defenders are racing to close it.

It is also worth building a habit of scrutinizing links before clicking, especially those received through email, messaging apps, or search results that lead to unfamiliar domains. Spoofed sites are designed to look convincing, so hovering over a link to check the actual destination URL, or navigating to a known site directly rather than clicking through, can prevent the initial compromise before it starts.

Actionable Takeaways

  • Update Chrome and Windows as soon as patches become available, particularly following zero-day disclosures like this one.
  • Avoid clicking unfamiliar links, and verify URLs before entering credentials or downloading files.
  • Security teams should review Volexity's published indicators of compromise for CLEANGULP, including file, persistence, and C2 details, and check them against endpoint and network logs.
  • Treat browser security updates with the same urgency as operating system patches; both were exploited together in this campaign.
  • Stay informed about ongoing zero-day disclosures, since chained exploitation across multiple products is an increasingly common attacker technique.