cyber.hendryadrian.com
Threat Research · picussecurity.com

BlueMoon Exploit Kit Chains Chrome and Windows Flaws to Deliver Malware

· Original article ↗

Summary

BlueMoon campaigns use spearphishing links and a Chrome/V8-to-Windows kernel exploit chain to run malware outside the browser sandbox. Four espionage-focused clusters delivered payloads including GemStone and ShadowPad.

Key points

  • BlueMoon was first observed on August 28, 2026, and targeted Windows users through links to attacker-controlled exploit pages.
  • The exploit chain uses CVE-2026-85046 for V8 type confusion, CVE-2026-87491 for V8 sandbox escape, and CVE-2026-85880 for Windows kernel privilege escalation.
  • After profiling the host, the kit injects code into the browser’s broker process to download and run a payload outside the renderer sandbox.
  • The full chain worked only on supported Windows builds; a vulnerable browser alone was insufficient.
  • Four espionage-focused threat clusters adopted the kit, delivering GemStone, ShadowPad, a Rust loader, and custom malware with a .NET stage.
  • Campaigns used persistence methods including browser-extension installation, scheduled tasks, and registry changes.

Article Details

Attack Vectors
  • Spearphishing emails contain links to attacker-controlled exploit pages serving BlueMoon.
  • BlueMoon chains CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 to escape the browser sandbox, escalate privileges, and execute a downloaded payload outside the renderer sandbox.
  • After host and build checks, the exploit injects code into the browser's parent broker process, which runs the payload download command.
  • Campaign-specific persistence included browser-extension installation, scheduled tasks, and registry changes.
Defensive Notes
  • The full exploit chain succeeds only on supported Windows builds; a vulnerable browser alone is insufficient.
  • The article recommends testing security controls against BlueMoon-related threats using the Picus Platform.

Indicators of compromise

TypeIndicatorContext
DOMAINasianstudies[.]secboxes[.]comAttacker-controlled exploit page linked from TA412 spearphishing emails.

MITRE ATT&CK

T1053.005 · Scheduled TaskSome campaigns use scheduled tasks for persistence, including a task named EdgeCore_AutoUpdate.T1055 · Process InjectionAfter the kernel exploit succeeds, BlueMoon injects code into the browser's parent broker process.T1056.001 · KeyloggingGemStone collects keystrokes.T1059.007 · JavaScriptJavaScript in the browser worker controls the exploit chain, retries, and payload selection.T1105 · Ingress Tool TransferThe broker-process command downloads the selected executable, by default msgbox.exe.T1113 · Screen CaptureGemStone collects screenshots.T1189 · Drive-by CompromiseVisiting an attacker-controlled website triggers the BlueMoon browser exploit chain.T1547.001 · Registry Run Keys / Startup FolderSome campaigns persist by installing a browser extension and modifying browser preferences.T1566.002 · Spearphishing LinkSpearphishing emails deliver links to attacker-controlled BlueMoon exploit pages.

CVE

CVE-2026-85046CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 enable V8 type confusion, sandbox escape, and kernel privilege escalation respectively.CVE-2026-85880CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 enable V8 type confusion, sandbox escape, and kernel privilege escalation respectively.CVE-2026-87491CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880 enable V8 type confusion, sandbox escape, and kernel privilege escalation respectively.

Threat Actors

APT31Named in Picus Threat Library entries for campaign malware-download and email threats; the article does not otherwise detail its use of BlueMoon.TA412Used BlueMoon in spearphishing campaigns targeting US nonprofit groups, mining companies, and commodity traders.UNK_LateNightUsed BlueMoon in a campaign that delivered ShadowPad.

Malware

BlueMoon Exploit KitBlueMoon Exploit Kit, first observed on August 28, 2026, turns visits to malicious websites into Windows malware execution.GemStoneFour espionage-focused threat clusters adopted BlueMoon to deliver GemStone, ShadowPad, a Rust loader, and custom .NET-staged malware.ShadowPadFour espionage-focused threat clusters adopted BlueMoon to deliver GemStone, ShadowPad, a Rust loader, and custom .NET-staged malware.

Vendors

Picus SecurityProofpointKelly et al., "Once in a BlueMoon: Multiple state-aligned threat actors rapidly adopt novel exploit chain using Chrome and Windows zero-days," Proofpoint Threat Insight Blog, Sep.

Products

Google ChromeChrome and other Chromium-based browsers on WindowsPicus PlatformWe strongly suggest simulating BlueMoon Exploit Kit Attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Platform.

Countries

IndonesiaCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].SingaporeCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].United StatesVietnamCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].

Industries

AerospaceCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].Commodity tradingCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].ConsultingCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].financialCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].GovernmentCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].ManufacturingCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].MiningCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].NonprofitCampaigns targeted the US and Southeast Asia, including Vietnam, Indonesia, and Singapore, across nonprofit, mining, commodity trading, aerospace, manufacturing, government, consulting, and financial sectors [1].

Related Articles