New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
Proofpoint and Volexity report that multiple espionage clusters share the BlueMoon exploit kit, chaining Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC local privilege escalation CVE-2026-85880. Proofpoint observed spearphishing use since August 28 by JungleBamboo (APT31), while Volexity saw UTA0560 targeting NGOs from September 1; UNK_LateNight hit US aerospace/defense with ShadowPad and UNK_DoubleCheck targeted Vietnamese manufacturers. The kit's maintainers reverse-engineer public Chromium fixes before stable Chrome releases, and Proofpoint suspects the ALPC exploit has existed since 2025.
- Chains V8 type confusion (CVE-2026-85046), V8 sandbox escape (CVE-2026-87491), and Windows ALPC LPE (CVE-2026-85880).
- Four activity clusters identified; payloads include loaders, Grimwedge, ShadowPad, and an in-memory Rust loader.
- Maintainers exploit the gap between public Chromium fixes and stable Chrome releases to build exploits.
- IOCs published by Proofpoint and Volexity; broader adoption, possibly by criminal actors, expected.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1055 Process InjectionT1105 Ingress Tool Transfer
- Products
- Google ChromeMicrosoft Windows
- Threat actors
- JungleBambooAPT31UTA0560UNK_LateNightUNK_DoubleCheck
- Organizations
- ProofpointVolexity
- Countries
- ChinaUnited StatesVietnam
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
3 min read at bleepingcomputer.com
Multiple cyber-espionage groups deployed an exploit kit dubbed "BlueMoon" that leveraged zero-day vulnerabilities in Microsoft Windows and Google Chrome. [...]
By Bill Toulas · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.