Four groups caught using the same Chrome and Windows exploit kit
Proofpoint reports at least four hacking groups, some China-linked, share the BlueMoon exploit kit chaining Chromium and Windows kernel vulnerabilities to install malware.
Proofpoint named the nearly identical kit BlueMoon; it chains two Chromium vulnerabilities with one Windows kernel privilege-escalation flaw affecting Windows 10 (October 2018 Update and 2004), Windows Server 2019 and 2022, and the initial Windows 11 release. All three vulnerabilities received patches within 24 hours of the activity. The kit is being actively used by at least four hacking groups, some with Chinese government ties. Proofpoint links the rapid, visible sharing of a historically rare full browser exploit chain to the Chromium supply-chain patch gap and AI-assisted exploit development.
- BlueMoon chains two Chromium vulnerabilities with one Windows kernel privilege-escalation bug.
- At least four groups use the same kit; some have ties to the Chinese government.
- Proofpoint links rapid sharing to the Chromium patch gap and AI-assisted exploit development.
- All three vulnerabilities were patched within 24 hours of exploitation.
- ATT&CK
- T1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1190 Exploit Public-Facing Application
- Vendors
- Proofpoint
- Organizations
- Proofpoint
- Countries
- China
From the original article
2 min read at proofpoint.com
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government.
proofpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.