China-Linked Group Deploys GRIMWEDGE via Zero-Day Chain

Attribution from The Hacker News (September 15): a China-linked threat actor has been running a spear-phishing campaign that chains recently patched Chrome and Windows vulnerabilities to deliver GRIMWEDGE, a JavaScript backdoor. The report does not name the specific CVEs being exploited or identify the threat group by a formal designation.

Delivery

Spear-phishing, not drive-by kit. The attacker targets specific individuals by email; the target has to open a controlled link. That constrains scope to selected organizations or individuals rather than mass infection.

From the link, a two-stage exploit fires. A Chrome-side flaw provides initial code execution inside the browser. A Windows privilege escalation bug then breaks out of the browser sandbox and reaches the OS. That sequence converts a browser-level compromise into full OS access without further action from the target.

The same Chrome-plus-Windows two-stage structure was documented in the BlueMoon exploit kit on September 13. BlueMoon’s operators were described as espionage-motivated but not attributed to a country. Whether the GRIMWEDGE campaign uses BlueMoon components is unconfirmed.

Payload

GRIMWEDGE is a JavaScript backdoor. JavaScript implants run in any environment with a JS engine and produce traffic that blends with legitimate web activity. Post-exploitation capabilities of GRIMWEDGE are not detailed in the current reporting.

Context

On September 14, China-aligned UNC3569 deployed GrayRabbit through a chained Sogou input method flaw. Two separate China-attributed campaigns targeting Windows systems via chained application flaws in the same 24-hour window. No infrastructure overlap has been confirmed between the two operations.

Google patched Chrome’s seventh actively exploited zero-day of 2026 on September 9, the same day Microsoft’s September Patch Tuesday addressed two actively exploited Windows vulnerabilities. Both patch sets are in scope for this campaign.

Defense

Install the latest Chrome update and apply Microsoft’s September 2026 cumulative patches. Spear-phishing delivery means email link inspection and user awareness are part of the attack surface, not just patching. Monitor for unexpected browser process outbound connections on systems that cannot patch immediately.