Last seven days
- First activity
- Sep 22, 2026
- Last activity
- Sep 22, 2026
- Feed role
- C2 / Distribution
- Host form
- 0 IP / 2 hostnames
CLEANGULP
CLEANGULP is a Windows backdoor used by the China-linked threat actor UTA0565 in targeted espionage operations against Asian government entities.
Profile source: Mallory opens in a new tabCLEANGULP
Family profile
CLEANGULP is a Windows backdoor used by the China-linked threat actor UTA0565 in targeted espionage operations against Asian government entities. It was delivered through phishing lures and cloned websites that exploited chained Google Chrome remote-code-execution vulnerabilities, CVE-2026-85046 and CVE-2026-87491, together with the Windows local privilege-escalation vulnerability CVE-2026-85880. CLEANGULP establishes persistence through a scheduled task and uses encrypted, encoded HTTP command-and-control communications. It can execute shell commands, enumerate running processes, upload and download files, and execute additional operator-supplied code, including beacon object files. The malware is implemented in C and employs control-flow flattening and indirect calls to impede analysis.
Capabilities
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Sep 22
Observed infrastructure
Reported operators
Threat actors
1 named in public reportingVolexity said UTA0565 used a payload from a previously undocumented malware family it tracks as “CLEANGULP.”
Exploited software
Vulnerabilities linked to CLEANGULP
3 CVEsMITRE ATT&CK
CLEANGULP in ATT&CK
14 distinct techniquesTechniques
14 techniques T1203 Exploitation for Client Execution T1583.001 Domains T1573 Encrypted Channel T1036.005 Match Legitimate Resource Name or Location T1053.005 Scheduled Task T1071.001 Web Protocols T1057 Process Discovery T1070.006 Timestomp T1105 Ingress Tool Transfer T1027 Obfuscated Files or Information T1068 Exploitation for Privilege Escalation T1041 Exfiltration Over C2 Channel T1559.001 Component Object Model T1036 Masquerading
