CTI · reported · 2026-09-12

China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1203 Exploitation for Client Execution Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1059 Command and Scripting Interpreter Execution
• T1555 Credentials from Password Stores Credential Access
• T1082 System Information Discovery Discovery

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Chrome Zero-Day Exploitation Chain - GRIMWEDGE and LONGTALE Payloads
id: f6a7b8c9-d0e1-2345-fabc-456789012345
status: experimental
description: Detects exploitation of Chrome zero-day CVE-2026-85046 with Windows kernel LPE and deployment of GRIMWEDGE/LONGTALE payloads
references:
  - https://gbhackers.com/
  - https://cyberpress.org/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1203
  - attack.privilege-escalation
  - attack.t1068
logsource:
  product: windows
  category: process_creation
detection:
  selection_chrome_child_spawn:
    ParentImage|endswith:
      - '\chrome.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_kernel_exploit_child:
    ParentImage|endswith:
      - '\csrss.exe'
      - '\lsass.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  selection_grimwedge_strings:
    CommandLine|contains:
      - 'GRIMWEDGE'
      - 'grimwedge'
      - 'LONGTALE'
      - 'longtale'
  condition: selection_chrome_child_spawn or selection_kernel_exploit_child or selection_grimwedge_strings
falsepositives:
  - Legitimate browser-initiated processes
  - Developer tools usage
level: critical

YARA-X raw

import "pe"

rule China_APT_GRIMWEDGE_Backdoor {
    meta:
        author = "Tia N. List"
        date = "2026-09-12"
        status = "experimental"
        description = "Detects GRIMWEDGE JScript backdoor deployed by China-linked APT31/JungleBamboo"
        reference = "https://gbhackers.com/"
        falsepositives = "Unknown"

    strings:
        $name1 = "GRIMWEDGE" ascii nocase
        $name2 = "grimwedge" ascii
        $name3 = "LONGTALE" ascii nocase
        $name4 = "longtale" ascii
        $jscript = "JScript" ascii
        $wscript = "WScript" ascii
        $eval = "eval(" ascii
        $create = "CreateObject" ascii
        $shell = "WScript.Shell" ascii
        $fso = "Scripting.FileSystemObject" ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize < 20MB and
        1 of ($name*) and
        2 of ($jscript, $wscript, $eval, $create, $shell, $fso)
}

References

• https://gbhackers.com/
• https://cyberpress.org/