UTA0560 Chain Exploits Three CVEs to Drop GRIMWEDGE on NGOs via Reflected XSS

Spear-phishing emails directed targets to the compromised university domain. The reflected XSS redirected Chrome-Windows visitors to actor-controlled infrastructure hosting three Base64-encoded shellcode stages. These stages performed V8 sandbox escape, ALPC-based process injection, and reconnaissance before the msgbox.exe loader sideloaded wsc.dll to fetch and execute the GRIMWEDGE MSI. The backdoor maintained an in-memory eval() loop polling ocr.opusaccel[.]top. Volexity documented the activity under UTA0560 while Proofpoint first mapped the CVE chain. A second cluster, JungleBamboo/APT31, reused the identical BlueMoon infrastructure days later to deploy SUPERSTOMP and LONGTALE. Both operations filtered non-Chrome-Windows systems at the landing page, confirming deliberate platform targeting rather than broad spraying. The pattern shows Chinese operators sharing zero-day chains across clusters without unified tooling. GRIMWEDGE’s lack of persistence or lateral movement indicates it functions as a lightweight foothold for subsequent custom implants. Contract and procurement records continue to show sustained PRC investment in browser and kernel exploitation capabilities. Additional NGOs are likely to see the same chain until full patch deployment and sinkholing of the C2 domain. Monitoring for new reflected XSS on academic sites and fresh MSI payloads will provide the earliest indicators of reuse.