Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
22 IOCs
Mind the (Patch) Gap, Part 2: Fake Websites Used to Deploy Chrome & Windows 0-Day Exploits
Malware Families
Excerpt
On September 9, 2026, Volexity published a blog post detailing the simultaneous use of multiple chained zero-day exploits in Google Chrome ( CVE-2026-85046 , CVE-2026-87491 ) and Microsoft Windows ( CVE-2026-85880 ) by two different Chinese advanced persistent threat (APT) actors. Shortly after that blog post was published, Volexity discovered additional campaigns—this time from a third Chinese threat actor, tracked by Volexity under the alias UTA0565 —that used the same…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →22 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21 | Medium | Score 53/100 | First seen |
| CVE | CVE-2026-85046 | High | Score 79/100 | First seen |
| Domain | outsourcingwise.com | High | Score 58/100 | First seen |
| Domain | outsourcingwise.net | High | Score 58/100 | First seen |
| Domain | halal-navi.net | High | Score 58/100 | First seen |
| Domain | theconversation.com | High | Score 58/100 | First seen |
| Domain | thecovnresation.net | Medium | Score 54/100 | First seen |
| URL | https://americanprgoress.top/chrome_cleanup.exe | High | Score 58/100 | First seen |
| Domain | halal-navi.com | High | Score 58/100 | First seen |
| Domain | chinadigitaltimes.top | High | Score 58/100 | First seen |
| SHA1 | 668aa5551315ab26b67118fbb29f8e4560a1e1af | Medium | Score 43/100 | First seen |
| IP | 96.9.125.52 | Medium | Score 54/100 | First seen |
| SHA256 | 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb | Medium | Score 42/100 | First seen |
| CVE | CVE-2026-85880 | High | Score 79/100 | First seen |
| Domain | borneobulletins.top | Medium | Score 63/100 | First seen |
| Domain | halaltak.net | High | Score 58/100 | First seen |
| Domain | halalketak.net | High | Score 58/100 | First seen |
| Domain | thecovnresation.com | High | Score 58/100 | First seen |
| MD5 | 177652713dad3c128bd9195abf2b7603 | Medium | Score 43/100 | First seen |
| Domain | borneobulletin.com.bn | High | Score 58/100 | First seen |
| CVE | CVE-2026-87491 | High | Score 74/100 | First seen |
| Domain | personclouds.com | Medium | Score 63/100 | First seen |
IOC Relationship Graph
Building graph…