Chinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
Proofpoint observed at least four state-aligned threat groups, starting with TA412/Violet Typhoon/APT31 on August 28, chaining three zero-days in the 'BlueMoon' exploit chain targeting Chrome, Chromium-based browsers and Microsoft Windows. The chain includes RCE flaws in Chromium's JavaScript engine (CVE-2026-85046, CVE-2026-87491) and a Windows Advanced Local Procedure Call privilege-escalation zero-day (CVE-2026-85880), enabling sandbox code execution, sandbox escape and system privileges. APT31 delivered the chain via phishing links to NGOs, mining and commodity trading firms in the US, installing a browser extension disguised as Google Gemini to surveil activity and steal credentials. Other groups (UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) targeted US aerospace, Vietnamese manufacturing, and Indonesian and Singaporean organizations; fewer than 20 victims were directly observed but the true count is likely higher.
- BlueMoon chain: two Chromium V8 RCE zero-days plus Windows ALPC privilege escalation
- APT31 struck first on Aug 28; activity peaked Sept 2-3 before Chrome patching
- Phishing lures installed a malicious browser extension disguised as Google Gemini
- Four espionage groups targeted US, Vietnam, Indonesia and Singapore victims
- Proofpoint expects the kit to proliferate to more actors as patches roll out
- ATT&CK
- T1566.002 Spearphishing LinkT1176 Browser ExtensionsT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege Escalation
- Vendors
- GoogleMicrosoftProofpoint
- Organizations
- China Ministry of State Security
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
| CVE-2026-87491 | Actively Exploited Out-of-Bounds Write in Google Chrome V8 | 8.8 | 4% | KEV | KEV |
From the original article
4 min read at cyberscoop.com
Multiple China-aligned threat groups exploited the defects quickly to target various organizations. Proofpoint said the activity is ongoing and expects it to widen. The post Chinese espionage groups swarm to exploit triple-link chain of zero-days appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.