CrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
Malware
ShadowPad
- Mentions · 7d1
- Mentions · 30d1
- All mentions7
- First seenAug 17, 2026
- Last mentioned19h ago
Timeline
7 articles · newest firstNew 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
85
China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks
China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.
80
Hackers Chain Chrome and Windows Zero-Days in New BlueMoon Exploit Kit Attacks
Multiple espionage actors, mostly China-nexus, are chaining Chrome V8 and Windows kernel zero-days (CVE-2026-85046, CVE-2026-85880) via the BlueMoon exploit kit against government and defense targets.
86
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.
82
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
85
Unit 42 Researchers Discover Multiple Espionage Operations Targeting Southeast Asian Government
Unit 42 attributes three espionage clusters targeting a Southeast Asian government to Stately Taurus, Alloy Taurus, and Gelsemium APTs.
70
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
Appears with
- UNK_LateNightthreat actor · 5
- UNK_DoubleCheckthreat actor · 5
- Googlevendor · 5
- UNK_QuietRacketthreat actor · 4
- Proofpointvendor · 4
- Microsoftvendor · 4
- APT31threat actor · 4
- Chromeproduct · 3
- GemStonemalware · 3
- TA412threat actor · 3
- US NGOsvictim · 2
- Chromiumproduct · 2
- ShadowPadproduct · 2
- Proofpointorganization · 2
- Windows 10product · 2
- Violet Typhoonthreat actor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.