CTI · reported · 2026-09-27

Chinese threat actor UTA0565 chained three zero-days — Chrome (CVE-2026-85046, CVE-2026-87491) and Windows ALPC (CVE-2026-85880) — via fak

Full story & timeline

MITRE ATT&CK

• T1189 Drive-by Compromise Initial Access
• T1203 Exploitation for Client Execution Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation
• T1204 User Execution Execution

Indicators

No curated indicators tied to this case.

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
• https://www.volexity.com/blog/2026/09/21/mind-the-patch-gap-part-2-fake-websites-used-to-deploy-chrome-windows-0-day-exploits/
• https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit
• https://thehackernews.com/2026/09/chinese-hackers-exploit-chrome-windows.html