Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Proofpoint links four espionage clusters, including China's APT31, using shared exploit kit BlueMoon chaining Chrome V8 and Windows ALPC zero-days.
Proofpoint reports a previously undocumented exploit kit, BlueMoon, chains Chrome V8 type confusion CVE-2026-85046 with an unassigned V8 sandbox escape and Windows ALPC heap overflow CVE-2026-85880 to achieve code execution and local privilege escalation. APT31 first used it on August 28, 2026 against US NGOs, mining, and commodity trading firms, deploying the GemStone browser backdoor disguised as a Google Gemini extension via the GhostChrome-X integrity bypass. UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket followed on September 2-3, targeting US aerospace, Vietnamese manufacturing, and Indonesian/Singaporean sectors with ShadowPad and sideloaded Rust and .NET payloads. Both V8 flaws were patch-gap zero-days, and verbose code suggests possible AI-assisted development.
- Attack flow: spear-phishing link, V8 RCE plus sandbox escape, ALPC LPE, then shellcode downloads cluster-specific payloads.
- Kit variants share the same chain, with obfuscation, custom landing pages, and OS checks.
- GhostChrome-X bypasses Chrome extension integrity to install the credential-stealing GemStone backdoor with C2.
- V8 exploits may derive from Google's v8CTF challenge framework; spread path between actors unknown.
- ATT&CK
- T1566.002 Spearphishing LinkT1203 Exploitation for Client ExecutionT1068 Exploitation for Privilege EscalationT1574.002 DLL Side-LoadingT1053.005 Scheduled Task
- Vendors
- ProofpointGoogleMicrosoft
- Threat actors
- APT31UNK_LateNightUNK_DoubleCheckUNK_QuietRacket
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 | Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046) | 8.8 | 2% | KEVPoC ×6 | KEV |
| CVE-2026-85880 | Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation | 7.8 | <1% | KEV | KEV |
From the original article
5 min read at thehackernews.com
Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.