4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
Proofpoint researchers report that at least four hacking groups, some with ties to the Chinese government, are actively using a nearly identical exploit kit named BlueMoon. The kit chains two Chromium browser vulnerabilities and one Windows kernel flaw affecting Windows 10, Windows 11 initial release, and a later Windows version to install malware of the attacker's choice. All three vulnerabilities received patches within the past 24 hours. Proofpoint attributes the kit's rapid, widely shared deployment to a Chromium patch-gap window and AI agents accelerating exploit development against publicly accessible upstream patches.
- BlueMoon chains two Chromium exploits with one Windows kernel exploit to deploy malware
- At least four threat actors, some with Chinese government ties, use the same kit
- All three exploited vulnerabilities were patched within the past 24 hours
- Rapid sharing linked to Chromium supply-chain patch gaps and AI-assisted exploit development
- A fully weaponized Chrome exploit chain has historically been a rare, high-value capability
- Vendors
- GoogleMicrosoftProofpoint
- Threat actors
- China-linked threat actors
- Organizations
- Proofpoint
- Countries
- China
From the original article
1 min read at arstechnica.com
A patch gap and the hastened pace of AI-based vulnerability discovery are likely contributors.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.