Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
28 IOCs
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
Threat Actors
Malware Families
Excerpt
On September 1, 2026, Volexity’s Network Security Monitoring (NSM) service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →28 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-85046 | High | Score 79/100 | First seen |
| SHA256 | cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0 | Medium | Score 53/100 | First seen |
| URL | https://proof.gitprogram.com/a4/j8 | High | Score 58/100 | First seen |
| SHA256 | 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 | Medium | Score 53/100 | First seen |
| SHA256 | d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b | Medium | Score 42/100 | First seen |
| SHA256 | 56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951 | Medium | Score 42/100 | First seen |
| SHA256 | 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc | Medium | Score 42/100 | First seen |
| SHA256 | e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0 | Medium | Score 53/100 | First seen |
| URL | http://cloud.shinewrist.net/ | High | Score 58/100 | First seen |
| SHA256 | 51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc | Medium | Score 53/100 | First seen |
| SHA256 | 337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d | Medium | Score 37/100 | First seen |
| Domain | d71bedcf-307a-4432-beec-ce943223d0e3.cfargotunnel.com | High | Score 58/100 | First seen |
| SHA256 | 7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c | Medium | Score 53/100 | First seen |
| SHA256 | 59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb | Medium | Score 53/100 | First seen |
| IP | 206.166.251.164 | High | Score 58/100 | First seen |
| SHA256 | 3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-85880 | High | Score 79/100 | First seen |
| URL | https://cloud.shinewrist.net/ | High | Score 58/100 | First seen |
| SHA256 | b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1 | Medium | Score 53/100 | First seen |
| Domain | document.gitprogram.com | High | Score 58/100 | First seen |
| URL | https://xyz0102.gitprogram.com/a001 | High | Score 58/100 | First seen |
| Domain | gitprogram.com | High | Score 58/100 | First seen |
| Domain | msbenefit.com | High | Score 64/100 | First seen |
| URL | https://ocr.opusaccel.top | High | Score 58/100 | First seen |
| CVE | CVE-2026-87491 | High | Score 74/100 | First seen |
| SHA256 | 5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6 | Medium | Score 53/100 | First seen |
| URL | https://photos.msbenefit.com/fb/w3z | High | Score 58/100 | First seen |
| URL | https://photos.msbenefit.com/fa/t3 | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…