Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects

UTA0565 leveraged a chain of three zero-day vulnerabilities in Chrome and Windows to compromise Asian government entities before any patches were publicly available, highlighting the severe risk posed by nation-state actors with access to undisclosed exploits. The use of fake websites and phishing emails as delivery mechanisms demonstrates that even sophisticated zero-day attacks rely on human interaction as an entry point. The apparent sharing of exploit kits across multiple Chinese threat groups suggests a coordinated ecosystem of offensive cyber tools, raising the stakes for defenders who may face the same exploit from multiple actors simultaneously. This incident underscores that zero-day exposure windows — however brief — can be catastrophically leveraged by well-resourced adversaries, making layered defenses and rapid patch deployment essential even when vulnerabilities are newly disclosed.