Security researchers at Volexity have attributed a spear-phishing campaign to a Chinese threat actor. The campaign exploited a chain of security flaws in Google Chrome and Microsoft Windows, both of which have since been patched. The attack chain was used to gain initial access to targets before delivering the final payload.
The payload is a malicious JavaScript backdoor called GRIMWEDGE. According to Volexity, the backdoor is deployed after the exploit chain succeeds. The researchers are tracking the threat cluster as part of their ongoing monitoring, though the specific cluster name is not included in the public summary.
This report is based on a single source, so there are no conflicting accounts to compare. The findings underscore the importance of applying browser and operating system patches promptly, as even recently fixed vulnerabilities can be actively exploited in the wild.