4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
Proofpoint researchers report that at least four hacking groups, some with ties to the Chinese government, are actively using a nearly identical exploit kit named BlueMoon. The kit chains two Chromium browser vulnerabilities and one Windows kernel flaw affecting Windows 10, Windows 11 initial release, and a later Windows version to install malware of the attacker's choice. All three vulnerabilities received patches within the past 24 hours. Proofpoint attributes the kit's rapid, widely shared deployment to a Chromium patch-gap window and AI agents accelerating exploit development against publicly accessible upstream patches.
- BlueMoon chains two Chromium exploits with one Windows kernel exploit to deploy malware
- At least four threat actors, some with Chinese government ties, use the same kit
- All three exploited vulnerabilities were patched within the past 24 hours
- Rapid sharing linked to Chromium supply-chain patch gaps and AI-assisted exploit development
- A fully weaponized Chrome exploit chain has historically been a rare, high-value capability
Full article339 words · extracted from arstechnica.com · click to collapse
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10, Windows 22, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
Deployed rapidly, widely shared
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.
Both these factors likely pushed the attackers to move quickly before a window of opportunity closed. Proofpoint said:
A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.
The four groups targeted a wide range of organizations and companies. The groups and targets included:
Text extracted automatically; images, tables and formatting may be missing. Original: https://arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/