Multiple State-Aligned Threat Actors Rapidly Adopt BlueMoon Chrome and Windows Exploit Chain

Article Details

Attack Vectors

• Targeted spearphishing links led to actor-controlled pages hosting the exploit kit, often followed by redirects to legitimate websites.
• Lures included internship inquiries, conference outreach, vaccination registration, and aerospace business and quotation requests. Some recipients received rapport-building messages before the exploit link.
• The browser exploit chain combined a V8 type-confusion vulnerability and V8 sandbox escape with a Windows kernel privilege-escalation vulnerability affecting older builds.
• The kernel exploit supported builds 17763, 19041–19045, 20348, and 22000, substantially limiting eligible targets.
• Post-exploitation shellcode injected into the parent browser process to download and execute payloads outside the renderer sandbox.
• Payload delivery included malicious browser-extension installation, DLL-sideloading chains, encrypted payloads loaded into memory, and scheduled-task persistence.

Defensive Notes

• Hunt for the distinctive default process tree chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe.
• Check for ChromeUpdate.exe or msgbox.exe dropped into %TEMP%.
• Look for scheduled tasks named EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, and GeForceService.
• Check Chrome sessionStorage for the key v8ctf_exp_attempt.
• Hunt for the mutex Dataupcheckinfo.
• Investigate persistence-related writes to HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32.
• The supplied MAL_BlueMoon_ExploitKit YARA rule matches three or more listed exploit-code or shellcode markers, including Base64 variants.
• ET rules 2071919–2071924 cover exploit loaders and outbound beacons; rules 2071996–2072001 cover browser-extension registration, heartbeat, ingestion, screenshots, command polling, and command results.
• Both browser vulnerabilities were already fixed in public upstream code but remained unpatched in stable browser releases during the observed activity; upstream fixes alone did not establish downstream protection.
• The extension installer forged valid Secure Preferences HMACs and super_mac values, so those integrity checks did not prevent the observed malicious extension installation.