Search: “ta412”

China-Linked Hackers Exploit Chrome and Windows Zero-Days in BlueMoon Attacks

China-linked clusters deploy the BlueMoon kit chaining Chrome V8 CVE-2026-85046 and Windows LPE CVE-2026-85880 in espionage campaigns.

Proofpoint researchers identified BlueMoon, an exploit kit combining a V8 type-confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel privilege-escalation flaw (CVE-2026-85880), first observed August 28, 2026. At least four clusters adopted it, led by TA412 (also tracked as APT31/Violet Typhoon) and followed by UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket, targeting aerospace, manufacturing, government, consulting, and financial sectors. The kit exploited a nearly four-week patch gap between the public Chromium commit (August 7) and stable rollout (September 3). TA412 delivered the GemStone Chrome extension masquerading as a Gemini companion, while other clusters deployed ShadowPad via DLL sideloading, a Rust loader, and DoH-based C2.

GBHackers·Sep 10, 05:15 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

Four Nation-State Actors Used the Same Chrome Zero-Day Exploit Kit Within 12 Days

Proofpoint reports four nation-state actors, mostly China-nexus, adopted the BlueMoon Chrome and Windows zero-day exploit kit within 12 days, targeting US organizations.

Proofpoint tracked an exploit kit dubbed BlueMoon that chains CVE-2026-85046, a Chrome V8 type-confusion bug, with an unnamed V8 sandbox escape and CVE-2026-85880, a Windows kernel privilege escalation using ALPC and the Windows Notification Facility. The first observed use was by China-nexus TA412 (APT31, Violet Typhoon, JungleBamboo) on August 28, 2026 against US NGOs, mining companies, and commodity trading firms, followed by UNK_LateNight targeting US aerospace and defense companies on September 2. Both V8 bugs were patch-gap zero-days: the fix was committed to Chromium on August 7 but reached stable Chrome on September 3, enabling rapid weaponization from public patches. TA412's post-exploitation payload, GemStone, is a malicious browser extension posing as an AI-powered Google Gemini companion that captures keystrokes, cookies, screenshots, and browsing history via a Cloudflare Worker C2.

Security Affairs·Sep 10, 05:35 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits

Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.

Proofpoint identified a new exploit kit, BlueMoon, first observed on August 28 and used by TA412 (APT31/Violet Typhoon) against US NGOs, mining firms, and commodity trading companies. The kit chains a V8 type confusion RCE (CVE-2026-85046), a V8 sandbox escape, and a Windows Advanced Local Procedure Call privilege escalation (CVE-2026-85880), both patched flaws having been exploited in the wild. At least four espionage groups, most with suspected China nexus including UNK_LateNight, adopted the kit within days, targeting US aerospace firms with defense-sector lures. Fewer than 20 organizations were observed targeted, and researchers believe AI-assisted exploit development against upstream Chromium patches enabled the kit's rapid creation and sharing.

The Register · Security·Sep 9, 22:28 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-858801

China-Linked Hackers Chain Chrome Zero-Day With Windows Kernel Flaw in Attacks

Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.

Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.

GBHackers·updated Sep 15, 10:17 UTC · 2d ago·first Sep 12, 08:04 UTC · 5d agoExploit / PoC in the wild 8 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858802· 1 read

Chinese espionage groups swarm to exploit triple-link chain of zero-days

Four China-aligned espionage groups, starting with TA412/APT31, chained zero-days CVE-2026-85046, CVE-2026-87491 and CVE-2026-85880 to spy on targets since late August.

TA412 (Violet Typhoon/APT31) began exploiting the BlueMoon chain on Aug. 28, followed by UNK_LateNight (US aerospace, Sept. 2), UNK_DoubleCheck (Vietnamese manufacturing via a compromised Southeast Asian government account) and UNK_QuietRacket (Indonesia and Singapore government, consulting and finance, Sept. 3). The chain pairs Chromium JavaScript engine RCE flaws CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC privilege-escalation zero-day CVE-2026-85880, enabling sandbox escape and system privileges. Delivery used phishing links installing a fake Google Gemini browser extension that surveilled browser activity and stole credentials; Proofpoint directly observed fewer than 20 organizations but expects wider proliferation as the kit spreads.

Proofpoint Threat Insight·Sep 9, 21:17 UTC · 7d agoThreat actor in the wild 3 sourcesCVE-2026-85046CVE-2026-87491CVE-2026-858804

Multiple Chinese hacking groups seen using identical Chrome zero-day exploit

Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.

Proofpoint identified at least four Chinese-aligned espionage groups (TA412/RedBravo, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket) using an identical Chrome zero-day exploit kit dubbed BlueMoon in late August through this week. Targets include US defense contractors, NGOs, mining companies, and Southeast Asian government agencies. The exploit chains a Chromium patch-gap vulnerability with a Windows flaw, delivering malware such as ShadowPad and a fake Gemini browser extension backdoor, with possible AI-assisted exploit development.

The Record·Sep 9, 16:30 UTC · 7d agoExploit / PoC in the wild 2 sources1

Microsoft linked attacks on SharePoint flaws to China

Security Affairs·Jul 23, 06:20 UTC · Jul 23, 2025RansomwareCVE-2025-53770