BlueMoon Exploit Kit Chains Chrome and Windows Flaws Across Espionage Campaigns
Summary
Proofpoint reports that BlueMoon chains Chrome and Windows flaws in espionage campaigns linked to APT31 and other clusters. Attacks install varied payloads and persistence; patching Chrome does not remove existing implants.
Key points
- Proofpoint linked the first observed in-the-wild use of BlueMoon, on August 28, 2026, to APT31; several other clusters adopted it within days.
- The kit chains two Chrome V8 flaws—including a sandbox escape without a CVE—with Windows ALPC flaw CVE-2026-85880 to gain code execution and elevate privileges.
- Phishing lures lead targets to malicious links that trigger the browser exploits; reflective DLLs fingerprint hosts and run the Windows privilege-escalation exploit.
- Observed campaigns delivered different payloads, including the GemStone browser-surveillance and credential-theft backdoor, ShadowPad, and DLL sideloading chains.
- Some campaigns established persistence with malicious browser extensions or scheduled tasks, which may remain after browser updates.
- Google and Microsoft patched the cited CVEs, and CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog; Proofpoint published detection rules for the loader and C2 traffic.
- Proofpoint said it is unknown how the distinct groups obtained the kit and whether AI tools assisted its development.
Article Details
- Attack Vectors
- Spear-phishing emails and malicious links directed targets to actor-controlled pages serving the BlueMoon exploit kit.
- BlueMoon chained Chrome V8 vulnerabilities for code execution and sandbox escape with a Windows ALPC vulnerability for local privilege escalation.
- The exploit chain used reflectively loaded DLLs, injector shellcode, and a curl command to download and execute payloads.
- Some campaigns used DLL sideloading to deploy payloads, including ShadowPad and other malware.
- APT31's campaign installed a malicious browser extension disguised as Google Gemini; other observed persistence included scheduled tasks.
- Defensive Notes
- Patch Chrome and Windows to address CVE-2026-85046 and CVE-2026-85880; the article notes that browser patching alone does not remove already-installed persistence.
- For potentially targeted systems, check for the reported Chrome-to-cmd-to-curl-to-msgbox process chain, ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder, C:UsersPublicstomp_ext, the named scheduled tasks, mutex Dataupcheckinfo, and the reported registry key.
- Proofpoint published detection rules 2071919 through 2071924 for BlueMoon's JavaScript loader and command-and-control traffic.
MITRE ATT&CK
T1053.005 · Scheduled TaskUNK_QuietRacket's in-memory .NET payload created a scheduled task to relaunch the DLL sideloading sequence.T1055 · Process InjectionInjector shellcode injected a CreateProcess stub into the parent Chrome broker process.T1059.003 · Windows Command ShellThe exploit chain's default command used cmd.exe and curl to download and execute a remote executable.T1068 · Exploitation for Privilege EscalationThe exploit chain used the Windows ALPC vulnerability CVE-2026-85880 for local privilege escalation.T1105 · Ingress Tool TransferThe default command downloaded remotely hosted executables, and the UNK_DoubleCheck payload fetched a second DLL sideloading pair from a Cloudflare R2 Bucket.T1189 · Drive-by CompromiseBlueMoon exploited Chrome V8 vulnerabilities when targets visited actor-controlled pages.T1204.001 · Malicious LinkTargets were tricked into clicking malicious links that initiated the BlueMoon exploit chain.T1547.001 · Registry Run Keys / Startup FolderThe GemStone browser add-on provided persistence through a malicious Chrome extension.T1555.003 · Credentials from Web BrowsersThe GemStone browser-surveillance and credential-theft backdoor was installed as a browser extension.T1566.001 · Spearphishing AttachmentAPT31 and other clusters used spear-phishing lures to direct targets to malicious links serving BlueMoon.T1574.002 · DLL Side-LoadingSeveral campaigns used DLL sideloading to deploy payloads.
CVE
People
David GalazinProofpoint researcher cited as an author of the technical analysis.Greg LesnewichProofpoint researcher cited as an author of the technical analysis.Julia PaluchProofpoint researcher cited as an author of the technical analysis.Konstantin KlingerProofpoint researcher cited as an author of the technical analysis.Mark KellyProofpoint researcher cited as an author of the technical analysis.Saher NaumaanProofpoint researcher cited as an author of the technical analysis.Stuart Del CalizProofpoint researcher cited as an author of the technical analysis.
Threat Actors
APT31The article attributes BlueMoon's first known in-the-wild use to APT31. The source explicitly lists Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle, and Violet Typhoon as alternate names for APT31.JungleBambooThe source explicitly identifies JungleBamboo as an alternate name for APT31, which it attributes with BlueMoon's first known in-the-wild use.TA412The source explicitly identifies TA412 as an alternate name for APT31, which it attributes with BlueMoon's first known in-the-wild use.UNK_LateNightA China-aligned threat cluster reported using BlueMoon and ShadowPad against U.S. aerospace companies.Violet TyphoonThe source explicitly identifies Violet Typhoon as an alternate name for APT31, which it attributes with BlueMoon's first known in-the-wild use.
Malware
Vendors
GoogleMultiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.MicrosoftMultiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.ProofpointProofpoint linked the first in-the-wild use to APT31 and said the kit quickly spread to other China-aligned clusters while leaving behind persistence mechanisms such as malicious extensions and scheduled tasks.
Products
ChromiumThe enterprise security company said the flaws had already been fixed in public upstream Chromium source code, but were yet to be propagated to the latest stable releases of Chrome and Chromium-based browsers available.Cloudflare R2 BucketThe malware, for its part, contacts a Cloudflare R2 Bucket to fetch and execute a second DLL sideloading pair.Cloudflare Workerslures to target a Vietnamese manufacturing entity to send victims to an actor-controlled Cloudflare Workers domain hosting BlueMoon, which is then used to initiate a DLL sideloading attack to drop a RustGoogle ChromeMultiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.Google Geminiand runs a loader executable responsible for installing a malicious browser add-on disguised as Google Gemini using a Chrome extension integrity bypass technique called GhostChrome-X.Microsoft WindowsMultiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome.
Tools
GhostChrome-Xbrowser add-on disguised as Google Gemini using a Chrome extension integrity bypass technique called GhostChrome-X.v8CTFThis is also bolstered by repeated references to the v8CTF challenge, an exploit-focused vulnerability reward program (VRP) and capture-the-flag (CTF) competition run by Google targeting the V8 engine.
Countries
Indonesiathat used spear-phishing lures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landing pages that deploy BlueMoon.Singaporelures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landing pages that deploy BlueMoon.
Industries
Aerospaceaerospace companies and lead victims to malicious links that deploy BlueMoon and the ShadowPad backdoor using DLL sideloading.ConsultingSeptember 3, 2026), a China-aligned threat actor that used spear-phishing lures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landing pages thatfinanciala China-aligned threat actor that used spear-phishing lures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landing pages that deploy BlueMoon.Government(Beginning on September 3, 2026), a China-aligned threat actor that used spear-phishing lures to target government, consulting, and financial sector organizations in Indonesia and Singapore to take victims to landingManufacturing(Beginning on September 2, 2026), which used spear-phishing lures to target a Vietnamese manufacturing entity to send victims to an actor-controlled Cloudflare Workers domain hosting BlueMoon, which isMiningAPT31 (Beginning on August 28, 2026), which used spear-phishing lures to target non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the U.S.Non-governmental organizationsAPT31 (Beginning on August 28, 2026), which used spear-phishing lures to target non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the U.S.Physical commodity tradingAPT31 (Beginning on August 28, 2026), which used spear-phishing lures to target non-governmental organizations (NGOs), mining companies, and physical commodity trading firms in the U.S.