GRIMWEDGE & SUPERSTOMP 0-Day Chain: UTA0560 and JungleBamboo Exploit CVE-2026-85880 in NGO Targeting Campaign

---
title: Chrome Exploitation Followed by Suspicious Child Process (UTA0560 / JungleBamboo)
id: 7a1f3c2e-9b44-4f1d-a5e2-202610100001
status: experimental
description: Detects Chrome spawning command shells or script interpreters, consistent with post-exploitation activity after CVE-2026-85046 / CVE-2026-87491 renderer compromise observed in the GRIMWEDGE campaign.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\chrome.exe'
    selection_img:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_img
falsepositives:
    - Rare enterprise browser extensions invoking local helpers
level: high
tags:
    - attack.execution
    - attack.t1203
    - attack.t1059
---
title: Malicious Chrome Extension Installation (GRIMWEDGE Persistence)
id: 8b2e4d3f-1c55-4a2e-b6f3-202610100002
status: experimental
description: Detects creation of new Chrome extension manifest files by non-browser processes, indicating sideloaded malicious extension persistence as used by GRIMWEDGE.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
logsource:
    category: file_event
    product: windows
detection:
    selection_path:
        TargetFilename|contains:
            - '\Google\Chrome\User Data\'
            - '\Chromium\User Data\'
    selection_file:
        TargetFilename|endswith:
            - '\Extensions\'
            - 'manifest.json'
    filter_browser:
        Image|endswith:
            - '\chrome.exe'
    condition: selection_path and selection_file and not filter_browser
falsepositives:
    - Enterprise extension deployment via management tooling (whitelist deployment accounts)
level: high
tags:
    - attack.persistence
    - attack.t1176
---
title: Network Connection to JungleBamboo C2 Infrastructure
id: 9c3f5e4a-2d66-4b3f-c7a4-202610100003
status: experimental
description: Detects DNS resolution or network connections to known GRIMWEDGE/SUPERSTOMP command-and-control infrastructure (msbenefit.com) associated with UTA0560 and JungleBamboo.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
logsource:
    category: dns
    product: windows
detection:
    selection:
        QueryName|contains:
            - 'msbenefit.com'
    condition: selection
falsepositives:
    - Threat research or sandbox detonation environments
level: critical
tags:
    - attack.command_and_control
    - attack.t1071.001

// Hunt for GRIMWEDGE/SUPERSTOMP campaign activity: Chrome child-process exploitation,
// C2 connections to msbenefit.com, and malicious extension persistence
let C2Domain = "msbenefit.com";
let KnownHashes = dynamic([
    "337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d",
    "3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f",
    "51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc",
    "56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951"
]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteUrl has C2Domain or RemoteUrl endswith ".msbenefit.com"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType, Signal="C2-Network"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(90d)
    | where InitiatingProcessFileName =~ "chrome.exe"
    | where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe")
    | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, Signal="Chrome-ChildProc"
    ),
    (
    DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where FolderPath has_any ("\\Google\\Chrome\\User Data\\","\\Chromium\\User Data\\")
    | where FolderPath has "\\Extensions\\" and FileName =~ "manifest.json"
    | where InitiatingProcessFileName !~ "chrome.exe"
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, Signal="Extension-Persistence"
    ),
    (
    DeviceFileEvents
    | where TimeGenerated > ago(90d)
    | where SHA256 in~ (KnownHashes)
    | project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, InitiatingProcessFileName, Signal="Known-Implant-Hash"
    )
| sort by TimeGenerated desc

# GRIMWEDGE / SUPERSTOMP / LONGTALE IOC Hunt Script
# Checks for malicious extension persistence, C2 connections, suspicious Chrome child
# processes, scheduled-task persistence, and known implant hashes.
# Run elevated. Output written to .\grimwedge_hunt_results.txt

$Results = @()
$C2Domain = "msbenefit.com"
$KnownHashes = @(
    "337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d",
    "3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f",
    "51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc",
    "56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951"
)

Write-Host "[*] Checking for live connections to JungleBamboo C2 ($C2Domain)..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $_.Entry -like "*$C2Domain*" }
if ($dnsCache) { $Results += "[ALERT] DNS cache hit for C2: $($dnsCache.Entry -join ', ')" }

Write-Host "[*] Scanning Chrome extension directories for suspicious manifests..." -ForegroundColor Cyan
$extPaths = @("$env:LOCALAPPDATA\Google\Chrome\User Data", "$env:LOCALAPPDATA\Chromium\User Data")
foreach ($base in $extPaths) {
    if (Test-Path $base) {
        Get-ChildItem -Path $base -Recurse -Filter "manifest.json" -ErrorAction SilentlyContinue |
            Where-Object { $_.FullName -like "*\Extensions\*" } | ForEach-Object {
                $mtime = $_.LastWriteTime
                $content = Get-Content $_.FullName -Raw -ErrorAction SilentlyContinue
                if ($content -match 'cookies|webRequest|<all_urls>|tabs' -and $mtime -gt (Get-Date).AddDays(-120)) {
                    $Results += "[SUSPICIOUS] Extension manifest: $($_.FullName) | Modified: $mtime"
                }
                $hash = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
                if ($KnownHashes -contains $hash.ToLower()) {
                    $Results += "[CRITICAL] Known implant hash match: $($_.FullName)"
                }
            }
    }
}

Write-Host "[*] Reviewing scheduled tasks for implant persistence..." -ForegroundColor Cyan
Get-ScheduledTask | Where-Object { $_.TaskPath -notlike "\Microsoft*" } | ForEach-Object {
    $action = ($_.Actions | Select-Object -First 1).Execute
    if ($action -match 'powershell|cmd.exe|wscript|rundll32' ) {
        $Results += "[REVIEW] Non-Microsoft scheduled task: $($_.TaskName) -> $action"
    }
}

Write-Host "[*] Checking Run keys for persistence artifacts..." -ForegroundColor Cyan
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    if (Test-Path $rk) {
        (Get-ItemProperty $rk).PSObject.Properties | Where-Object {
            $_.Value -match 'AppData|Temp|ProgramData' -and $_.Name -notmatch '^PS'
        } | ForEach-Object { $Results += "[REVIEW] Run key: $rk\$($_.Name) = $($_.Value)" }
    }
}

if ($Results.Count -eq 0) { Write-Host "[+] No IOC hits detected on this host." -ForegroundColor Green }
else {
    $Results | Out-File .\grimwedge_hunt_results.txt
    Write-Host "[!] $($Results.Count) findings written to .\grimwedge_hunt_results.txt" -ForegroundColor Red
    $Results | ForEach-Object { Write-Host $_ -ForegroundColor Yellow }
}