Warlock ransomware breach SharePoint in water, telecom operator attacks
Warlock ransomware exploited SharePoint ToolShell flaws to hit a water utility, telecom, government body, and university.
78
Threat actor
Violet Typhoon
- Mentions · 7d0
- Mentions · 30d2
- All mentions10
- First seenSep 9, 2026
- Last mentioned28d ago
Timeline
10 articles · newest firstWarlock Expands SharePoint Exploitation in Critical Infrastructure Attacks
Warlock ransomware operators continue exploiting unpatched SharePoint servers at critical infrastructure, government, and education targets.
80
BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
Proofpoint reports multiple espionage groups rapidly adopting BlueMoon, a new exploit kit chaining Chrome and Windows zero-days.
88
China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks
Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
85
Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days
Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.
85
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.
80
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
85
Chinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
88
Chinese espionage groups swarm to exploit triple-link chain of zero-days
Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.
85
Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
86
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2026-505223%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2026-5864416%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server
- CVE-2025-53770100%9.8Unauthenticated Deserialization RCE in Microsoft SharePoint Server on-premises
- CVE-2026-5504070%9.1Authentication Bypass in Microsoft SharePoint Server
- CVE-2026-4565980%8.8Authenticated Deserialization RCE in Microsoft SharePoint Server (Actively Exploited)
- CVE-2025-49704100%8.8Authenticated Code Injection RCE in Microsoft SharePoint
- CVE-2026-3220143%6.5Improper Input Validation Spoofing Vulnerability in Microsoft SharePoint Server
Appears with
- Microsoftvendor · 9
- APT31threat actor · 8
- TA412threat actor · 7
- Googlevendor · 7
- UNK_LateNightthreat actor · 7
- Google Chromeproduct · 5
- UNK_DoubleCheckthreat actor · 5
- Proofpointvendor · 5
- UNK_QuietRacketthreat actor · 5
- Google Geminiproduct · 4
- GemStonemalware · 4
- BlueMoonmalware · 3
- Proofpointorganization · 3
- China Ministry of State Securityorganization · 3
- Chromeproduct · 3
- Volexityvendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.