Key points
- Multiple Chinese threat actors used zero-day exploits in Google Chrome and Microsoft Windows simultaneously.
- Successful exploitation allows attackers to download and run malware on compromised systems.
- Volexity Volcano enabled reconstruction of attacker activity via memory and registry forensics.
Volexity researchers identified multiple Chinese threat actors employing zero-day exploits in Google Chrome and Microsoft Windows during recent campaigns. According to the security firm, these attacks aimed to download and execute malware on targeted systems if the initial exploitation succeeded.
The analysis, part of the "Mind the (Patch) Gap" series, focuses on the forensic reconstruction capabilities of Volexity Volcano. Researchers demonstrated how the tool processed data from a compromised virtual machine using exploit chains attributed to actor UTA0560. This allowed for detailed examination of attacker behaviour after initial access was gained.
Forensic Reconstruction Methods
Volexity used Surge Collect Pro to capture memory, registry hives, event logs, and file system artefacts from the test environment. Volcano then processed this data to reconstruct attacker activity. The analysis revealed memory-only components, including reflectively loaded DLLs and position-independent shellcode within the Chrome process.
The tool also detected anomalies related to system privileges and invalid parent-child process relationships. These indicators helped identify the persistence mechanisms established by the attackers. The combination of memory and file forensics provided a comprehensive view of the intrusion timeline.
Threat Actor Infrastructure
Volcano’s integration with Volexity’s Cyber Threat Intelligence feed enabled real-time lookups of malicious indicators. Subscribers received alerts for malicious IP addresses, DNS names, and YARA rules associated with the campaign. In the observed case, the hostname cloud.shinewrist[.]net was detected in event logs and command-line arguments.
This intelligence provided advance notice of attacker infrastructure. The alerts covered evidence supplied to Volcano from various sources, including command shells and curl processes. This integration enhances the speed and accuracy of incident response investigations.
What happens next
No patch or fix has been confirmed for these specific zero-day exploits yet. Security teams should monitor for the described indicators of compromise, including unusual Chrome process behaviour and connections to known malicious domains. Volexity continues to update its threat intelligence feeds with new indicators as they become available.
Why this attack works
Attackers exploit unpatched vulnerabilities in widely used software to bypass standard security controls. This technique serves the initial access stage of an intrusion, allowing them to execute code without user interaction. Teams usually monitor for anomalous process behaviour and unexpected network connections. Check whether your systems have recent updates applied and review logs for suspicious activity patterns.
What to do and how to stay safe: Volexity
- Monitor endpoint logs for reflectively loaded DLLs and position-independent shellcode in browser processes.
- Review network traffic for connections to newly identified malicious domains and IP addresses.
- Verify parent-child process relationships for anomalies indicating privilege escalation or persistence.
- Ensure forensic collection tools are configured to capture memory and registry artefacts during incidents.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which threat actors are behind these Chrome and Windows zero-day exploits?
Volexity identified multiple Chinese threat actors, including UTA0560, using these exploits simultaneously.
What software is affected by these zero-day vulnerabilities?
The exploits target unpatched flaws in Google Chrome and Microsoft Windows operating systems.
How did Volexity reconstruct the attacker's activity?
Researchers used Volexity Volcano and Surge Collect Pro to analyse memory, registry, and file system artefacts.
