Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.
- Four or more China-linked groups used the same BlueMoon exploit kit
- Exploited a four-week Chrome patch gap after Chromium fix was public
- Targets include US defense, NGOs, and Southeast Asian governments
- TA412 deployed fake Gemini extension for credential theft; LateNight used ShadowPad
- Debugging comments suggest possible AI-assisted exploit development
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1189 Drive-by CompromiseT1105 Ingress Tool TransferT1176 Browser Extensions
- Vendors
- GoogleProofpoint
- Malware
- ShadowPad
- Organizations
- Ministry of State Security
- AI models
- Gemini
From the original article
4 min read at therecord.mediaA Google Chrome bug identified in August was exploited by at least four China-linked cyber-espionage groups, according to researchers.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.