60
60
60
60
60
60
60
60
60
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws
Multiple China-linked espionage groups share the BlueMoon exploit kit chaining Chrome V8 zero-days and a Windows ALPC LPE to deploy backdoors.
Proofpoint and Volexity report that multiple espionage clusters share the BlueMoon exploit kit, chaining Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC local privilege escalation CVE-2026-85880. Proofpoint observed spearphishing use since August 28 by JungleBamboo (APT31), while Volexity saw UTA0560 targeting NGOs from September 1; UNK_LateNight hit US aerospace/defense with ShadowPad and UNK_DoubleCheck targeted Vietnamese manufacturers. The kit's maintainers reverse-engineer public Chromium fixes before stable Chrome releases, and Proofpoint suspects the ALPC exploit has existed since 2025.
85
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.
Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.
85
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
60
CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
60
60
60
60