Volexity says two separately tracked Chinese threat actors used the identical three-vulnerability exploit chain, two Chrome flaws and one Windows Advanced Local Procedure Call bug, to compromise targets at non-governmental organizations in a spear-phishing campaign detected on September 1. One cluster, tracked as UTA0560, deployed a JavaScript backdoor the researchers named GRIMWEDGE. The other, JungleBamboo, also known as APT31 or Violet Typhoon, used the same chain to install a credential-stealing Chrome extension called LONGTALE. “These links abused a reflected cross-site scripting vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain,” Volexity researchers Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, and Tom Lancaster wrote.
The chain’s first stage exploits the same Chrome V8 sandbox flaw, CVE-2026-87491, that CyberTech previously reported Google had confirmed was under attack. Volexity’s disclosure adds a detail that matters for defenders more than attribution does: the underlying flaw had already been fixed in open-source Chromium code before the campaign began, but the patched version had not yet reached released builds of Google Chrome. Organizations running an up-to-date, generally available Chrome were exposed anyway, because the fix existed upstream without yet existing downstream.
The original insight here is less about either APT cluster individually and more about what it means that two independently tracked operators, with different targets and different post-exploitation malware, converged on the exact same three-CVE chain within the same narrow window. That points to exploit chains circulating or being rediscovered fast enough that a patch-gap window, the moment between an upstream fix and its release build, has become a shared resource across multiple nation-state operators rather than one group’s exclusive advantage, a pattern consistent with CyberTech’s earlier reporting on a commercial vendor supplying hacking tools to Chinese state operators.
Source: Volexity
