Recent investigations have unveiled a series of espionage-driven threat activity clusters utilizing a novel exploit kit known as BlueMoon. This kit is particularly notable for its ability to exploit multiple vulnerabilities within Microsoft Windows and Google Chrome.
Emergence of BlueMoon
The first recorded deployment of BlueMoon in the wild has been linked to APT31, a state-sponsored group aligned with China, on August 28, 2026. Following this initial usage, several other espionage-focused clusters swiftly adopted the exploit kit, most of which are suspected to have ties to China. However, Proofpoint’s report indicates that the kit may not be exclusively utilized by China-aligned actors, as some instances remain unattributed, suggesting a broader adoption.
BlueMoon exploits a chain of three specific vulnerabilities:
- CVE-2026-85046: A type confusion vulnerability in the V8 engine of Google Chrome.
- A V8 sandbox escape that lacks an assigned CVE identifier.
- CVE-2026-85880: A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC).
While Google addressed CVE-2026-85046 last week, Microsoft included a fix for CVE-2026-85880 in its September 2026 Patch Tuesday updates. Interestingly, both V8 vulnerabilities were exploited as “patch-gap” zero-days, meaning they had been fixed in the public upstream Chromium source code but had yet to be implemented in the latest stable versions of Chrome and other Chromium-based browsers.
It appears that the developers behind BlueMoon were closely monitoring publicly available Chromium patches to assemble their exploit chain. The attack vectors leveraging BlueMoon typically commence with phishing emails designed to lure targets into visiting a malicious URL. This URL triggers the two V8 vulnerabilities in succession, allowing for code execution and subsequent escape from the browser sandbox. Following this, the Windows local privilege escalation (LPE) vulnerability is exploited to inject shellcode that downloads various payloads tailored to the specific threat cluster involved.
According to Proofpoint researchers, the exploit kit employs a reflectively loaded DLL to fingerprint the Windows host. This information is then utilized by the JavaScript in the exploit kit to determine whether to proceed with the LPE exploit. A second reflectively loaded DLL executes the LPE exploit to elevate the renderer process. With these enhanced privileges, a separate injector shellcode is employed to introduce a CreateProcess stub into the parent Chrome broker process, executing a command specified by the operator. The default command typically downloads and executes a remotely hosted executable using a curl command.
Multiple variants of the BlueMoon exploit kit have been detected, showcasing subtle modifications that either remove comments or obfuscate components. Some variants even incorporate campaign-specific landing pages, redirects, browser-side operating system checks, or additional telemetry, although the fundamental exploit chain remains unchanged.
Detailed Attack Chains
A brief overview of the observed attack chains includes:
- APT31 (Beginning August 28, 2026): This group targeted non-governmental organizations (NGOs), mining companies, and commodity trading firms in the U.S. using spear-phishing lures. Victims were tricked into clicking a malicious link that deployed BlueMoon, which subsequently downloaded a loader executable responsible for installing a malicious browser add-on disguised as Google Gemini. This add-on, dubbed GemStone, functions as a browser surveillance and credential theft backdoor, allowing the threat actor to issue commands through a command-and-control (C2) channel.
- UNK_LateNight (Beginning September 2, 2026): This China-aligned cluster targeted U.S. aerospace companies with spear-phishing lures leading to malicious links that deployed BlueMoon alongside the ShadowPad backdoor via DLL sideloading.
- UNK_DoubleCheck (Beginning September 2, 2026): This group targeted a Vietnamese manufacturing entity, directing victims to an actor-controlled Cloudflare Workers domain hosting BlueMoon. This was then used to initiate a DLL sideloading attack to drop a Rust binary, which subsequently contacted a Cloudflare R2 Bucket to fetch and execute a second DLL sideloading pair.
- UNK_QuietRacket (Beginning September 3, 2026): Another China-aligned actor, this group targeted government, consulting, and financial organizations in Indonesia and Singapore. They led victims to landing pages deploying BlueMoon, which was modified to download and execute a DLL sideloading pair. The rogue DLL communicated with Cloudflare Workers domains to obtain and execute a .NET assembly in memory, designed to create a scheduled task for persistence.
Notably, the source code artifacts exhibit extensive logging capabilities and verbose comments, suggesting that artificial intelligence (AI) tools may have assisted in the malware’s development. This is further supported by references to the v8CTF challenge, a vulnerability reward program and capture-the-flag competition run by Google targeting the V8 engine.
While it remains unclear whether the V8 exploits were genuinely developed within the v8CTF bug bounty framework, or if this framing was merely a tactic employed by exploit developers to circumvent large language model (LLM) guardrails, the ease of access to the exploit kit raises concerns about its proliferation among espionage and financially motivated threat actors.
The Cybersecurity and Infrastructure Security Agency (CISA) added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, mandating that U.S. federal civilian agencies apply patches by September 18, 2026. However, simply updating the browser does not eliminate existing threats, as malicious extensions and scheduled tasks may persist post-patch. Those potentially affected should monitor for specific indicators of compromise, including:
- Process tree: chrome.exe initiating cmd.exe, followed by curl.exe and msgbox.exe.
- File: ChromeUpdate.exe or msgbox.exe located in the Windows %TEMP% folder.
- Folder: C:UsersPublicstomp_ext.
- Scheduled task: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, or GeForceService.
- Mutex: Dataupcheckinfo.
- Registry key: HKCUSOFTWAREClassesCLSID{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}InprocServer32.
Proofpoint has also released detection rules for the kit’s JavaScript loader and its command-and-control traffic, numbered 2071919 through 2071924, to assist organizations in identifying and mitigating these threats.
Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Recent investigations have unveiled a series of espionage-driven threat activity clusters utilizing a novel exploit kit known as BlueMoon. This kit is particularly notable for its ability to exploit multiple vulnerabilities within Microsoft Windows and Google Chrome.
Emergence of BlueMoon
The first recorded deployment of BlueMoon in the wild has been linked to APT31, a state-sponsored group aligned with China, on August 28, 2026. Following this initial usage, several other espionage-focused clusters swiftly adopted the exploit kit, most of which are suspected to have ties to China. However, Proofpoint’s report indicates that the kit may not be exclusively utilized by China-aligned actors, as some instances remain unattributed, suggesting a broader adoption.
BlueMoon exploits a chain of three specific vulnerabilities:
While Google addressed CVE-2026-85046 last week, Microsoft included a fix for CVE-2026-85880 in its September 2026 Patch Tuesday updates. Interestingly, both V8 vulnerabilities were exploited as “patch-gap” zero-days, meaning they had been fixed in the public upstream Chromium source code but had yet to be implemented in the latest stable versions of Chrome and other Chromium-based browsers.
It appears that the developers behind BlueMoon were closely monitoring publicly available Chromium patches to assemble their exploit chain. The attack vectors leveraging BlueMoon typically commence with phishing emails designed to lure targets into visiting a malicious URL. This URL triggers the two V8 vulnerabilities in succession, allowing for code execution and subsequent escape from the browser sandbox. Following this, the Windows local privilege escalation (LPE) vulnerability is exploited to inject shellcode that downloads various payloads tailored to the specific threat cluster involved.
According to Proofpoint researchers, the exploit kit employs a reflectively loaded DLL to fingerprint the Windows host. This information is then utilized by the JavaScript in the exploit kit to determine whether to proceed with the LPE exploit. A second reflectively loaded DLL executes the LPE exploit to elevate the renderer process. With these enhanced privileges, a separate injector shellcode is employed to introduce a CreateProcess stub into the parent Chrome broker process, executing a command specified by the operator. The default command typically downloads and executes a remotely hosted executable using a curl command.
Multiple variants of the BlueMoon exploit kit have been detected, showcasing subtle modifications that either remove comments or obfuscate components. Some variants even incorporate campaign-specific landing pages, redirects, browser-side operating system checks, or additional telemetry, although the fundamental exploit chain remains unchanged.
Detailed Attack Chains
A brief overview of the observed attack chains includes:
Notably, the source code artifacts exhibit extensive logging capabilities and verbose comments, suggesting that artificial intelligence (AI) tools may have assisted in the malware’s development. This is further supported by references to the v8CTF challenge, a vulnerability reward program and capture-the-flag competition run by Google targeting the V8 engine.
While it remains unclear whether the V8 exploits were genuinely developed within the v8CTF bug bounty framework, or if this framing was merely a tactic employed by exploit developers to circumvent large language model (LLM) guardrails, the ease of access to the exploit kit raises concerns about its proliferation among espionage and financially motivated threat actors.
The Cybersecurity and Infrastructure Security Agency (CISA) added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026, mandating that U.S. federal civilian agencies apply patches by September 18, 2026. However, simply updating the browser does not eliminate existing threats, as malicious extensions and scheduled tasks may persist post-patch. Those potentially affected should monitor for specific indicators of compromise, including:
Proofpoint has also released detection rules for the kit’s JavaScript loader and its command-and-control traffic, numbered 2071919 through 2071924, to assist organizations in identifying and mitigating these threats.