BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days in Espionage Campaigns
Summary
Proofpoint reports that multiple espionage groups rapidly adopted BlueMoon, which chains two Chrome zero-days and a Windows privilege-escalation flaw. The kit targeted organizations in several countries.
Key points
- Proofpoint says China-linked Violet Typhoon first used BlueMoon on August 28, with other threat actors adopting it within days.
- The kit chained Chrome vulnerabilities CVE-2026-85046 and CVE-2026-87491 with Windows privilege-escalation flaw CVE-2026-85880; all were patched in September 2026.
- The reported chain uses the Chrome flaws to escape the sandbox, fingerprints the host, then runs Windows privilege-escalation code and downloads and executes a file.
- Reported targets included US NGOs, mining and commodity-trading firms, aerospace companies, and organizations in Vietnam, Indonesia, and Singapore.
- Proofpoint found multiple packaging variations with the same underlying exploit chain and loading mechanisms.
- Proofpoint said development artifacts might indicate AI use, but no single artifact conclusively confirms it.
Article Details
- Event Type
- Multiple espionage groups adopted the BlueMoon exploit kit, which chains recently disclosed Chrome and Windows zero-days.
- Impact
- The kit was used in attacks targeting NGOs, mining entities, commodity trading firms, aerospace companies, a manufacturing organization, and government, consulting, and financial entities across the US, Vietnam, Indonesia, and Singapore. It exploited Chrome V8 vulnerabilities for sandbox escape and a Windows ALPC privilege-escalation vulnerability, then downloaded and executed an executable. Proofpoint reported that the kit was rapidly shared among multiple threat actors; it said the artifacts suggest AI may have been used in development, but no single artifact conclusively confirms this.
CVE
CVE-2026-85046Tracked as CVE-2026-85046 and CVE-2026-87491, the Chrome flaws were patched as zero-days on September 3 and September 8, respectively.CVE-2026-85880The Windows zero-day, tracked as CVE-2026-85880, was fixed on September 2026 Patch Tuesday. It is a privilege escalation in Windows Advanced Local Procedure Call (ALPC).CVE-2026-87491Tracked as CVE-2026-85046 and CVE-2026-87491, the Chrome flaws were patched as zero-days on September 3 and September 8, respectively.
Threat Actors
APT Violet TyphoonChina-linked espionage group reported by Proofpoint as the first to use BlueMoon.APT31Name given by the source as another tracking name for APT Violet Typhoon.JungleBambooName given by the source as another tracking name for APT Violet Typhoon.TA412Name given by the source as another tracking name for APT Violet Typhoon.UNK_DoubleCheckThreat actor reported to have used BlueMoon against a manufacturing organization in Vietnam.UNK_LateNightChina-linked espionage group reported to have used BlueMoon against US aerospace companies.UNK_QuietRacketChinese espionage group reported to have used BlueMoon against entities in Indonesia and Singapore.
Vendors
Products
BlueMoonMultiple espionage groups have been using a new exploit kit dubbed BlueMoon in seemingly opportunistic and rushed deployments, cybersecurity firm Proofpoint reports.Google ChromeThe BlueMoon exploit kit was adopted fast because it chains together three vulnerabilities that were unpatched when it first emerged: two zero-days in Chrome and one in Windows.Microsoft WindowsThe BlueMoon exploit kit was adopted fast because it chains together three vulnerabilities that were unpatched when it first emerged: two zero-days in Chrome and one in Windows.
Countries
ChinaThe China-linked APT Violet Typhoon (also tracked as APT31, JungleBamboo, TA412, and Tide Castle) was the first to use it on August 28.IndonesiaThe next day, Chinese espionage group UNK_QuietRacket started using it in attacks against government, consulting, and financial entities in Indonesia and Singapore.SingaporeThe next day, Chinese espionage group UNK_QuietRacket started using it in attacks against government, consulting, and financial entities in Indonesia and Singapore.United StatesBlueMoon was initially used by Violet Typhoon in attacks targeting NGOs in the US, as well as mining entities and physical commodity trading firms.Vietnamcompanies, and a threat actor tracked as UNK_DoubleCheck targeted a manufacturing organization in Vietnam.
Industries
Aerospace2, a second China-linked espionage group, tracked as UNK_LateNight, used it against multiple US aerospace companies, and a threat actor tracked as UNK_DoubleCheck targeted a manufacturing organization inCommodity tradingBlueMoon was initially used by Violet Typhoon in attacks targeting NGOs in the US, as well as mining entities and physical commodity trading firms.ConsultingThe next day, Chinese espionage group UNK_QuietRacket started using it in attacks against government, consulting, and financial entities in Indonesia and Singapore.GovernmentThe next day, Chinese espionage group UNK_QuietRacket started using it in attacks against government, consulting, and financial entities in Indonesia and Singapore.Manufacturingit against multiple US aerospace companies, and a threat actor tracked as UNK_DoubleCheck targeted a manufacturing organization in Vietnam.MiningBlueMoon was initially used by Violet Typhoon in attacks targeting NGOs in the US, as well as mining entities and physical commodity trading firms.