Known malicious kithighother
UTA0560 — Chrome/Windows 0-day exploit hosting and GRIMWEDGE command-and-control
family: uta0560-chrome-0day-2026-09
Short link:scanmalware.com/h/203
Infrastructure published by Volexity for UTA0560, one of the Chinese threat actors that chained Google Chrome (CVE-2026-85046, CVE-2026-87491) and Windows (CVE-2026-85880) zero-days in early September 2026. shinewrist[.]net and cloud.shinewrist[.]net hosted the exploit chain; opusaccel[.]top and its subdomains (ocr., www.) served as command-and-control for the GRIMWEDGE backdoor.
Anchors
SMQL queryrun
domain:shinewrist.net OR domain:opusaccel.top OR contacted_host:shinewrist.net OR contacted_host:*.shinewrist.net OR contacted_host:opusaccel.top OR contacted_host:*.opusaccel.top OR ip:206.166.251.164Provenance
Added: 2026-09-23 15:26
Matches a page scanned on these domains or any of their subdomains, a page that requested one, and the published address 206.166.251[.]164 (cloud.shinewrist[.]net). Some opusaccel[.]top hostnames now sit behind a shared CDN; those CDN addresses are deliberately not included.
References:
- https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/
- https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09%20Chrome
- https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit
Sightings (0)
No sightings recorded yet.