other

CLEANGULP

Malware family named by Volexity, written in C, heavily obfuscated with control flow flattening, and using HTTP command-and-control with AES-256-GCM encrypted bodies.

Current clusters

security1 publisher

A third Chinese APT ran the same Chrome and Windows zero-day chain from spoofed news sites

Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.

Publishers:volexity.com

Reality

Evidence72
Adoption58
Hype gap+8
Incentives52
Confidence64