Intelligence Brief: Escalating Zero-Day Chains and Targeted Backdoor Deployments (September 2026)

Executive Summary

The current threat landscape as of late September 2026 is characterized by a marked increase in the weaponization of zero-day vulnerabilities to achieve remote code execution (RCE) and sandbox escapes. Recent intelligence confirms that sophisticated actors are chaining browser-based vulnerabilities with OS-level flaws to gain persistent access. This report details the operational tactics of groups like UTA0565 and UNC3569, focusing on the deployment of the CLEANGULP and GrayRabbit malware families.

Background & Context

Cyber espionage groups are increasingly moving away from traditional phishing toward the exploitation of software supply chains and widely deployed utility applications. The recent exploitation of the Tencent Sogou Input Method (CVE-2026-51990) and the Google Chrome-Windows zero-day chain (CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880) highlights a trend where attackers target the 'trusted' layer of the user environment. By compromising these components, adversaries can bypass standard security controls that monitor for suspicious network traffic or unauthorized process execution.

Analysis

The deployment of CLEANGULP by UTA0565 represents a sophisticated approach to post-exploitation. By chaining two Chrome vulnerabilities with a Windows Advanced Local Procedure Call (ALPC) flaw, the attackers successfully broke out of the browser sandbox. This technique is indicative of a well-resourced actor capable of developing or acquiring multi-stage exploit chains.

Similarly, the UNC3569 group's use of the Sogou Input Method vulnerability demonstrates a focus on high-value targets. The GrayRabbit backdoor, once deployed, provides the attacker with a persistent foothold, allowing for data exfiltration and further lateral movement within the victim's network. The use of crafted links to trigger these exploits suggests a highly targeted delivery mechanism rather than broad-spectrum spraying.

Key Findings

• Zero-Day Chaining: Attackers are successfully combining browser-based vulnerabilities with kernel-level flaws to achieve full system compromise.
• Targeted Backdoors: The emergence of CLEANGULP and GrayRabbit indicates a continued investment in custom, modular malware designed for long-term espionage.
• Software Vulnerability: Widely used utility software, such as input methods, is being treated as a primary attack vector due to its high privilege level and user trust.
• Rapid Exploitation: The window between vulnerability disclosure and active exploitation is shrinking, necessitating faster patch cycles for non-traditional software.

Attribution & Confidence

We attribute the CLEANGULP campaign to the threat actor UTA0565 with high confidence, based on the specific exploit chain and infrastructure patterns observed. The GrayRabbit activity is attributed to the UNC3569 group, a China-aligned actor, with moderate-to-high confidence, given the targeting of regional software and established TTPs associated with this group.

Defensive Recommendations

1. Patch Management: Prioritize immediate updates for Google Chrome and all Windows components, specifically focusing on ALPC-related security patches.
2. Application Control: Implement strict application allow-listing to prevent the execution of unauthorized binaries, particularly those originating from input method directories or temporary folders.
3. Network Segmentation: Isolate critical systems from the public internet to limit the impact of potential browser-based RCEs.
4. Endpoint Monitoring: Deploy EDR solutions configured to detect anomalous process spawning from browser and input method processes.

Outlook

We anticipate that the trend of exploiting browser-to-kernel chains will continue as attackers seek to bypass increasingly robust sandbox protections. Organizations should expect further activity from actors like UTA0565 and UNC3569 as they refine their toolsets. Future intelligence efforts will focus on identifying the command-and-control (C2) infrastructure associated with these new malware families to provide better detection signatures.