Volexity caught two Chinese groups running byte-identical Chrome exploit code against NGOs

After the click, the only thing the user sees is an image of a donation form built for their own organization, a lure theme UTA0560 has used before ^[12]. Exploitation runs behind the picture and ends with code injected into the Chrome browser process and a payload of the operator's choosing on disk ^[9]. Link reputation does not help, because the address in the mail belongs to the university, not the attacker ^[2]. The first attacker-controlled host in the UTA0560 cluster is cloud.shinewrist[.]net ^[13].

Chrome and the other Chromium-based browsers are built from the Chromium tree ^[14], so a fix can exist in source while every installed browser stays vulnerable. Volexity's framing is exact: an N-day at the source level, a zero-day for Chrome users ^[6]. On a managed fleet the distinction collapses into one fact, which is that there was no build to deploy.

Twenty-eight days separate the August 4 report to Chromium from the September 1 detection ^[15]. That is an outer bound on the exposure window: Volexity gives no date for the fix commit and does not claim either actor derived the exploit from reading it ^[17]. The published evidence establishes the gap and its effect on victim machines, without establishing a route from the public commit to these two campaigns.

Two clusters with separate infrastructure and separate final payloads carrying identical shellcode ^[10] points to a chain built once and handed to both operators. Volexity does not name a builder or a supplier ^[17]. The durable half of that chain is the tail. A Chrome release retires the V8 entry point ^[7]. The WebAssembly sandbox escape ^[8] and the Windows kernel bug that lifts code out of the renderer ^[9] keep working with whatever read/write primitive someone finds next, and Volexity's account does not state the release status of fixes for either ^[18].

UTA0560's September mail matched lures that Volexity watched fail against its own customers in March ^[11]. Same customer set, same donation theme, five months later with a browser chain attached; the source does not say what the March attempts carried. That pattern is worth logging: an actor with a fixed target list, retrying a working lure until the delivery mechanism caught up.

While a gap like this is open, the indicators are hosts and downloads. Volexity named three: cloud.shinewrist[.]net ^[13], plus proof.gitprogram[.]com and photos.msbenefit[.]com on the JungleBamboo side ^[10].