Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.
- BlueMoon chains a Chromium V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows ALPC privilege escalation (CVE-2026-85880).
- TA412/APT31 first used the kit on August 28 against US NGOs, mining, and commodity trading firms.
- UNK_LateNight used BlueMoon from September 2 against US aerospace companies using RFQ phishing lures.
- The GemStone browser extension masquerades as Google Gemini to steal cookies, take screenshots, and log keystrokes via keyword triggers.
- Both V8 bugs were patch-gap zero-days, weaponized from publicly available upstream Chromium commits.
- ATT&CK
- T1566.002 Spearphishing LinkT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1176 Browser ExtensionsT1113 Screen Capture
- Vendors
- ProofpointGoogleMicrosoft
- Threat actors
- TA412APT31Violet TyphoonUNK_LateNight
- Organizations
- China Ministry of State Security
- Countries
- United StatesChina
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
5 min read at theregister.comAt least four espionage groups, most with suspected links to China, are using a new exploit kit that chains two Chromium-based browser flaws and one Microsoft Windows bug to break into organizations' networks in the US and Southeast Asia.
By Jessica Lyons · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.