Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.

The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, and Violet Typhoon) on August 28, 2026.

"Within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus," Proofpoint said in a report published today. "However, BlueMoon may not be exclusive to China-aligned actors, as some usage remains unattributed and there are also potentially more actors using the exploit kit."

The exploit chain employs three vulnerabilities -

• CVE-2026-85046, a type confusion in V8 in Google Chrome
• A V8 sandbox escape that does not have an assigned CVE identifier
• CVE-2026-85880, a heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC)

While CVE-2026-85046 was patched by Google last week, CVE-2026-85880 was addressed by Microsoft as part of its September 2026 Patch Tuesday updates.

Interestingly, both V8 vulnerabilities in Chrome are said to have been "patch-gap" zero-days at the time they were maliciously exploited. The enterprise security company said the flaws had already been fixed in public upstream Chromium source code, but were yet to be propagated to the latest stable releases of Chrome and Chromium-based browsers available.

It's suspected that the developer behind the exploit kit may have been closely keeping track of publicly available Chromium patches to put together the browser exploit chain.

Attack chains making use of BlueMoon have been found to rely on phishing emails as a starting point to trick targets into visiting an actor-controlled URL that triggers the two V8 flaws in succession to achieve code execution and escape the browser sandbox, and then exploit the Windows local privilege escalation bug to inject shellcode that downloads multiple payloads depending on the threat cluster behind it.

"Following the Chrome exploits, the kit uses a reflectively loaded DLL to fingerprint the Windows host, which the exploit kit JavaScript uses to decide whether to attempt the LPE exploit," Proofpoint researchers Mark Kelly, Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, and Stuart Del Caliz said.

"A second reflectively loaded DLL runs the LPE exploit to elevate the renderer process. With those additional privileges, a separate injector shellcode injects a CreateProcess stub into the parent Chrome broker process, executing an operator-specified command. The default command downloads a remotely hosted executable via a curl command and executes it."

Multiple variants of the exploit kit have been detected with subtle changes that removed comments or obfuscated its components, while others incorporate campaign-specific landing pages and redirects, browser-side operating system checks, or additional telemetry. Despite these modifications, the underlying exploit chain remains the same.

A brief description of the observed attack chains is as follows -

• APT31 (Beginning on August 28, 2026), which used spear-phishing lures to target non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the U.S. to trick victims into clicking on a malicious link that serves BlueMoon, which then downloads and runs a loader executable responsible for installing a malicious browser add-on disguised as Google Gemini using a Chrome extension integrity bypass technique called GhostChrome-X. The extension is a browser-surveillance and credential-theft backdoor dubbed GemStone that allows the threat actor to issue commands through a command-and-control (C2) channel.
• UNK_LateNight (Beginning on September 2, 2026), a China-aligned threat cluster which used spear-phishing lures to target multiple U.S. aerospace companies and lead victims to malicious links that deploy BlueMoon and the ShadowPad backdoor using DLL sideloading.
• UNK_DoubleCheck (Beginning on September 2, 2026), which used spear-phishing lures to target a Vietnamese manufacturing entity to send victims to an actor-controlled Cloudflare Workers domain hosting BlueMoon, which is then used to initiate a DLL sideloading attack to drop a Rust binary. The malware, for its part, contacts a Cloudflare R2 Bucket to fetch and execute a second DLL sideloading pair.
• UNK_QuietRacket (Beginning on September 3, 2026), a China-aligned threat actor that used spear-phishing lures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landing pages that deploy BlueMoon. The exploit kit, in this case, has been modified to download and execute a DLL sideloading pair. The rogue DLL communicates with Cloudflare Workers domains to obtain and run a .NET assembly in memory. The .NET in-memory payload is designed to create a scheduled task to launch the DLL sideloading sequence for persistence.

What's more, the presence of extensive logging capabilities and verbose comments within the source code artifacts suggests the malware may have been developed with assistance using artificial intelligence (AI) tools. This is also bolstered by repeated references to the v8CTF challenge, an exploit-focused vulnerability reward program (VRP) and capture-the-flag (CTF) competition run by Google targeting the V8 engine.

Proofpoint said it's not known if the V8 exploits were genuinely developed against the v8CTF bug bounty framework, or if this framing was used by the exploit developers to bypass large language model (LLM) guardrails.

"It is currently unknown how multiple distinct threat actors obtained access to the exploit kit," Proofpoint said. "Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers."

"A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals."

"This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases."

CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on 4 September, giving U.S. federal civilian agencies until 18 September to patch.

However, updating the browser closes the way in. It does not remove anything already installed. The GemStone extension and the scheduled tasks the other groups created survive a patch, so anyone who may have been targeted should check for the following.

• Process tree: chrome.exe starting cmd.exe, then curl.exe, then msgbox.exe
• File: ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder
• Folder: C:\Users\Public\stomp_ext
• Scheduled task: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup or GeForceService
• Mutex: Dataupcheckinfo
• Registry key: HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32

Proofpoint also published detection rules for the kit's JavaScript loader and its command-and-control traffic, numbered 2071919 through 2071924.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.