Acronis September 2026 Threat Report Finds BlueMoon Zero-Day Kit Used by Four Espionage Groups
Summary
Acronis’s September 2026 report says four espionage groups used the BlueMoon kit, which chained three Chrome and Windows zero-days. Endpoint malware detections fell to 4.3%, while URL-based threats rose in most focus countries.
Key points
- Acronis says four nation-state espionage groups used BlueMoon between late August and mid-September, with two more groups adopting it after initial campaigns.
- The kit chained CVE-2026-85046 and CVE-2026-87491 in Chrome with Windows flaw CVE-2026-85880 to achieve code execution and SYSTEM-level privilege escalation.
- BlueMoon was delivered through spear-phishing lure documents and fake browser-update pages; Google and Microsoft issued patches in mid-September.
- Acronis reported that 4.3% of its monitored clients had at least one malware threat blocked in September, down from 4.9% in August.
- Palestine had the highest normalized malware detection rate at 37.4%; Iraq entered the top three at 27.5%, and Vietnam recorded 22.3%.
- URL-based threat detections rose in most focus countries, with the largest reported increase in Italy and notable gains in New Zealand, France, and Canada.
Article Details
- Publisher
- Acronis Threat Research Unit
- Report Period
- September 2026
- Scope
- Global cyberthreat activity, including endpoint malware detections and URL-based threat detections; also reports on the BlueMoon exploit kit.
- Sample Size
- More than one million unique endpoints worldwide.
- Key Statistics
- Approximately 4.3% of unique Acronis clients had at least one malware threat blocked at the endpoint in September 2026, down from 4.9% in August.
- The September 2026 endpoint malware rate was the lowest recorded in 2026; the report compares it with 6.8% in April, 6.4% in March, and 3.7% in January.
- Palestine had the highest normalized malware detection rate among the reported countries at 37.4%; Iraq was at 27.5% and Vietnam at 22.3%.
- Four separate espionage groups reportedly adopted BlueMoon within a 12-day window.
- BlueMoon reportedly chained three zero-day vulnerabilities: CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880.
- Recommendations
- Use multilayered protection that includes behavior-based detection, AI- and ML-trained detections, and anti-ransomware heuristics.
- Use additional email security and URL filtering to help protect against social engineering threats.
CVE
CVE-2026-85046BlueMoon chains three specific vulnerabilities: CVE-2026-85046, a type-confusion flaw in Chrome's V8 JavaScript engine that enables remote code execution inside the browser process; CVE-2026-87491, a V8 sandbox escapeCVE-2026-85880CVE-2026-87491, a V8 sandbox escape that promotes that execution out of the renderer sandbox; and CVE-2026-85880, a heap-based buffer overflow in the Windows ALPC subsystem that escalates privileges to SYSTEM.CVE-2026-87491flaw in Chrome's V8 JavaScript engine that enables remote code execution inside the browser process; CVE-2026-87491, a V8 sandbox escape that promotes that execution out of the renderer sandbox; and CVE-2026-85880, a
People
Threat Actors
Vendors
AcronisAcronis Threat Research UnitGoogleBy the time Google and Microsoft issued patches in mid-September, at least two further espionage groups had adopted BlueMoon, bringing the total to four distinct actors exploiting the same zero-day chain within a 12-dayMicrosoftBy the time Google and Microsoft issued patches in mid-September, at least two further espionage groups had adopted BlueMoon, bringing the total to four distinct actors exploiting the same zero-day chain within a 12-day
Products
Acronis Cyber PlatformAcronis Cyber Platform protects against both known and never-before-seen threats through a multilayered protection approach. This includes behaviour-based detection, AI- and ML-trained detections and anti-ransomwareAcronis GenAI Protectionemail security and URL filtering can help you protect against social engineering threats. Acronis GenAI Protection, natively integrated in the Acronis platform, gives you visibility and control over AI usage,Acronis XDRyou visibility and control over AI usage, blocks sensitive data sharing and detects harmful prompts. Acronis XDR brings the visibility needed to understand attacks while simplifying the context for administrators andGoogle Chromeindependently deployed a new exploit kit dubbed BlueMoon that chains three zero-day vulnerabilities in Chrome and Windows to achieve full code execution and privilege escalation.Microsoft Windowsdeployed a new exploit kit dubbed BlueMoon that chains three zero-day vulnerabilities in Chrome and Windows to achieve full code execution and privilege escalation.
Tools
Countries
AustraliaThe only markets that declined were India (-0.8 pp, from 10.2% to 9.4%), Germany (-0.6 pp, from 9.1% to 8.5%) and Australia (-0.6 pp, from 8.0% to 7.4%).Bangladeshof 4.0 percentage points. Iraq entered the top three for the first time this year at 27.5%, displacing Bangladesh, which had ranked second or third across July and August. Vietnam remained in the top three at 22.3%,Canadapp, from 7.2% to 9.2%), New Zealand (+1.4 pp, from 7.0% to 8.4%), France (+1.3 pp, from 7.3% to 8.6%) and Canada (+1.2 pp, from 8.6% to 9.8%).ColombiaSingapore remained flat at 10.0%, while Colombia surged to 10.0%, tying Singapore at the top of the focus group alongside the United States at 9.9%.FranceThe largest gains were in Italy (+2.0 pp, from 7.2% to 9.2%), New Zealand (+1.4 pp, from 7.0% to 8.4%), France (+1.3 pp, from 7.3% to 8.6%) and Canada (+1.2 pp, from 8.6% to 9.8%).GermanyThe only markets that declined were India (-0.8 pp, from 10.2% to 9.4%), Germany (-0.6 pp, from 9.1% to 8.5%) and Australia (-0.6 pp, from 8.0% to 7.4%).IndiaThe only markets that declined were India (-0.8 pp, from 10.2% to 9.4%), Germany (-0.6 pp, from 9.1% to 8.5%) and Australia (-0.6 pp, from 8.0% to 7.4%).Iraqretained the top position at 37.4%, easing from 41.4% in August — a decline of 4.0 percentage points. Iraq entered the top three for the first time this year at 27.5%, displacing Bangladesh, which had rankedItalyAugust, with most markets increasing — a reversal of August's mixed pattern. The largest gains were in Italy (+2.0 pp, from 7.2% to 9.2%), New Zealand (+1.4 pp, from 7.0% to 8.4%), France (+1.3 pp, from 7.3% toNew Zealand— a reversal of August's mixed pattern. The largest gains were in Italy (+2.0 pp, from 7.2% to 9.2%), New Zealand (+1.4 pp, from 7.0% to 8.4%), France (+1.3 pp, from 7.3% to 8.6%) and Canada (+1.2 pp, from 8.6% toPalestineSeptember, the top three countries with the highest malware detection rates saw notable reshuffling. Palestine retained the top position at 37.4%, easing from 41.4% in August — a decline of 4.0 percentage points.SingaporeSingapore remained flat at 10.0%, while Colombia surged to 10.0%, tying Singapore at the top of the focus group alongside the United States at 9.9%.United StatesSingapore remained flat at 10.0%, while Colombia surged to 10.0%, tying Singapore at the top of the focus group alongside the United States at 9.9%.Vietnamtime this year at 27.5%, displacing Bangladesh, which had ranked second or third across July and August. Vietnam remained in the top three at 22.3%, down from 28.5% the prior month.