Four groups caught using the same Chrome and Windows exploit kit
Proofpoint reports at least four hacking groups, some China-linked, share the BlueMoon exploit kit chaining Chromium and Windows kernel vulnerabilities to install malware.
Proofpoint named the nearly identical kit BlueMoon; it chains two Chromium vulnerabilities with one Windows kernel privilege-escalation flaw affecting Windows 10 (October 2018 Update and 2004), Windows Server 2019 and 2022, and the initial Windows 11 release. All three vulnerabilities received patches within 24 hours of the activity. The kit is being actively used by at least four hacking groups, some with Chinese government ties. Proofpoint links the rapid, visible sharing of a historically rare full browser exploit chain to the Chromium supply-chain patch gap and AI-assisted exploit development.
- BlueMoon chains two Chromium vulnerabilities with one Windows kernel privilege-escalation bug.
- At least four groups use the same kit; some have ties to the Chinese government.
- Proofpoint links rapid sharing to the Chromium patch gap and AI-assisted exploit development.
- All three vulnerabilities were patched within 24 hours of exploitation.
Full article349 words · extracted from proofpoint.com · click to collapse
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice. BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct. 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
Deployed rapidly, widely shared
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans.
Both these factors likely pushed the attackers to move quickly before a window of opportunity closed. Proofpoint said:
A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.
The four groups targeted a wide range of organizations and companies. The groups and targets included:
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.proofpoint.com/us/newsroom/news/four-groups-caught-using-same-chrome-and-windows-exploit-kit