BlueMoon: China-linked espionage groups rapidly adopt shared kit chaining Chrome V8 and Windows ALPC zero-days

At least four China-aligned espionage groups, starting with TA412/APT31 on Aug. 28, 2026, used a shared exploit kit dubbed BlueMoon to chain Chrome V8 zero-days CVE-2026-85046 and CVE-2026-87491 with Windows ALPC privilege-escalation zero-day CVE-2026-85880,…

Proofpoint and Volexity describe BlueMoon, an exploit kit chaining three zero-days: Chromium V8 type-confusion RCE CVE-2026-85046; a second V8 flaw, CVE-2026-87491, described as a V8 sandbox escape in Proofpoint-sourced reports and as a WebAssembly sandbox escape in Volexity-sourced reports; and CVE-2026-85880, a Windows ALPC privilege escalation that Security Affairs characterizes as a kernel LPE in RtlpCreateServerAcl leveraging the Windows Notification Facility. The chain yields sandbox code execution, sandbox escape and system-level privileges; per SecurityWeek, the kit fingerprints the host and injects a CreateProcess stub into the Chrome broker process to download and execute a payload via curl. BleepingComputer reports Proofpoint suspects the ALPC exploit has existed since 2025. Proofpoint first observed the kit on Aug. 28, 2026, used by TA412/APT31 (also tracked as Violet Typhoon and JungleBamboo) against US NGOs, mining firms and commodity trading companies via phishing links. Three more clusters adopted it within days: UNK_LateNight against US aerospace/defense firms with RFQ lures from Sept. 2 (ShadowPad payload, per BleepingComputer); UNK_DoubleCheck against Vietnamese manufacturers via a compromised Southeast Asian government account; and UNK_QuietRacket against Indonesian and Singaporean government, consulting and finance targets from Sept. 3. Proofpoint directly observed fewer than 20 targeted organizations; activity was ongoing as of Sept. 8, and CyberScoop reports it peaked Sept. 2–3 before Chrome patching. Volexity separately documented campaigns detected Sept. 1, 2026, in which UTA0560 and JungleBamboo (APT31) ran byte-identical exploit shellcode against NGOs but deployed different payloads: UTA0560 delivered GRIMWEDGE, an in-memory JScript backdoor with reconnaissance, file-management and command-execution capabilities (C2 ocr.opusaccel[.]top) via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install LONGTALE/GemStone, a fake Google Gemini Chrome extension harvesting cookies, session tokens, keystrokes, screenshots and browsing history, which Security Affairs says bypasses profile-integrity checks via a legacy HMAC fallback. Initial access in Volexity's cases abused reflected XSS on legitimate US university sites to redirect victims to hidden exploit iframes behind a donation-form image. Volexity's confidence that a shared developer sold or shared the chain is reported as medium by GBHackers but low by Security…