Encrygma Threat Intel Report: Escalating Zero-Day Chains and Emerging IoT Botnet Tactics

Executive Summary

The cybersecurity landscape as of early October 2026 is characterized by a high frequency of zero-day exploitation and the weaponization of complex vulnerability chains. Threat actors are demonstrating increased capability in bypassing modern security sandboxes, particularly within the Chrome-Windows ecosystem. This report analyzes the recent deployment of the CLEANGULP malware, the exploitation of Apple zero-day vulnerabilities, and the emergence of the ClingSTUN IoT botnet, providing actionable intelligence for defensive posture improvement.

Background & Context

Throughout late September and early October 2026, the Encrygma Threat Intel Unit has observed a shift toward more aggressive, multi-stage exploit chains. The reliance on browser-based entry points remains a primary vector for initial access. Recent intelligence indicates that threat actors are not only identifying individual vulnerabilities but are effectively chaining them to achieve remote code execution (RCE) and sandbox escape. This trend is compounded by the continued exploitation of legacy and IoT devices, which serve as persistent infrastructure for botnet operations.

Analysis

Recent activity involving the threat actor UTA0565 highlights the sophistication of current campaigns. By chaining two Chrome vulnerabilities (CVE-2026-85046, CVE-2026-87491) with a Windows Advanced Local Procedure Call flaw (CVE-2026-85880), the actor successfully deployed the CLEANGULP malware. This malware, compiled via Microsoft Visual C, demonstrates a modular design capable of deep system interaction.

Simultaneously, the mobile and desktop security landscape has been disrupted by the weaponization of an Apple out-of-bounds write flaw (CVE-2026-86950). This vulnerability allows for highly targeted attacks, suggesting that sophisticated actors are maintaining a diverse portfolio of zero-day exploits across different operating systems. Furthermore, the discovery of ClingSTUN, which repurposes unpatched IoT devices into proxy nodes, indicates that threat actors are actively seeking to obfuscate their C2 traffic by leveraging the vast, unmanaged surface area of connected devices.

Key Findings

• Zero-Day Chaining: Attackers are successfully combining browser and OS-level vulnerabilities to bypass sandbox protections, as seen in the UTA0565 campaign.
• CLEANGULP Malware: A new, modular malware family has been identified, utilizing the BlueMoon exploit kit for delivery and persistence.
• Apple Ecosystem Vulnerabilities: The weaponization of CVE-2026-86950 underscores the persistent risk to mobile and desktop users from high-severity memory corruption flaws.
• IoT Proxy Networks: The ClingSTUN malware is actively turning IoT devices into proxy nodes, complicating attribution and traffic analysis.
• Infrastructure Risks: Recent advisories regarding Kiteworks and other critical infrastructure components emphasize the need for proactive system maintenance and emergency patching.

Attribution & Confidence

We maintain high confidence that the UTA0565 actor is responsible for the CLEANGULP campaign, based on infrastructure overlap and the specific exploit chain utilized. Attribution for the Apple zero-day remains ongoing, though the sophistication of the exploit suggests a well-resourced threat actor. The ClingSTUN activity is currently being monitored for further indicators of compromise (IoCs) to determine the scope of the botnet.

Defensive Recommendations

1. Prioritize Patching: Immediate application of security updates for Chrome, Windows, and Apple products is critical to neutralize known zero-day chains.
2. Network Segmentation: Isolate IoT devices from critical business networks to prevent them from being used as proxy nodes for malicious traffic.
3. Endpoint Detection: Deploy advanced EDR solutions capable of detecting anomalous process behavior, such as the execution of unauthorized binaries like 'chrome_cleanup.exe'.
4. Traffic Monitoring: Implement robust egress filtering to identify and block traffic originating from known proxy nodes or suspicious C2 infrastructure.
5. Vulnerability Management: Regularly audit internet-facing assets for vulnerabilities listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Outlook

As we move through Q4 2026, we anticipate that threat actors will continue to refine their exploit chains, focusing on the intersection of browser security and OS kernel-level access. The use of AI-assisted C2 frameworks and the expansion of proxy botnets will likely increase. Organizations must shift from reactive patching to a proactive, threat-informed defense strategy to maintain resilience against these evolving tactics.