A third Chinese APT ran the same Chrome and Windows zero-day chain from spoofed news sites

americanprgoress[.]top pulled most of its content from the real Center for American Progress site, then added one element of its own: an iframe set to zero width, zero height and display:none, loading /config.html ^[8]. Volexity says config.html holds the same components as the Chrome and Windows exploits it had already analysed, with the implementation largely unchanged ^[9]. The edits are cosmetic apart from the payload swap: renamed variables, debug messages, comments, and an option to log data to an internal IP address ^[10].

That puts three Chinese APT actors on one exploit kit inside a week, with the third actor's copy differing from the earlier two mainly in what it drops ^[1][2][10]. Volexity did not disclose where the kit came from.

Volexity puts UTA0565's exploitation on September 3 and 4 ^[2] and published its first report on the chain on September 9 ^[1], so the earliest confirmed use of these three CVEs ran five to six days ahead of the first public warning ^[1]. Volexity says the vulnerabilities were still unpatched when UTA0565 used them ^[3].

The final binary, chrome_cleanup.exe, came from the same typosquat that served the exploit ^[11]. It is the first documented sample of a family Volexity calls CLEANGULP: C code built with Microsoft's Visual C compiler, then heavily obfuscated with control flow flattening and indirect calls ^[12]. Volexity worked it through dynamic analysis, locating and emulating its string de-obfuscation functions, and rates the resulting capability list high confidence on partial analysis ^[13].

The network indicators are easy to collect. This CLEANGULP instance calls one hardcoded C2 domain, thecovnresation[.]com, a typosquat of The Conversation ^[14], and every flow Volexity observed used HTTP ^[15]. The first beacon is a POST to /beacon/pre-register whose user agent stops at AppleWebKit/537.36, with no browser or version token after it ^[16]. The session identifier in the registration body does not conform to RFC 9562; it is time-based ^[18].

Bodies are AES-256-GCM encrypted, then Base64 encoded with a custom alphabet, and the AES key is the SHA256 of that alphabet string ^[17]. Volexity published both the alphabet and the resulting key, cbeeb7dd5e89261cde032825fd10bb80bad2e3fbf5b91fdc9137ad463ffa8f21 ^[17]. Anyone holding September packet captures of traffic to that domain can decrypt the beacons now.