China-aligned Groups Use BlueMoon Chain of Three Zero-Days in Espionage Campaigns
Summary
Proofpoint reports at least four China-aligned groups used the BlueMoon chain of three unpatched browser and Windows flaws for espionage since late August, targeting organizations in the U.S. and Southeast Asia.
Key points
- Proofpoint tracked at least four China-aligned espionage groups using the BlueMoon chain against Chrome, Chromium-based browsers, and Windows before public patches were available.
- The chain combines CVE-2026-85046 and CVE-2026-87491, browser JavaScript-engine remote-code execution flaws, with Windows privilege-escalation flaw CVE-2026-85880.
- The chain can run code in the browser sandbox, escape it, and gain system privileges, according to Proofpoint researcher Mark Kelly.
- TA412, also known as Violet Typhoon and APT31, used phishing lures against U.S. NGOs, mining companies, and commodity trading firms; Proofpoint says a delivered extension disguised as Google Gemini enabled browser surveillance, credential theft, and command execution.
- Other observed targets included U.S. aerospace firms and manufacturing, government, consulting, and financial organizations in Vietnam, Indonesia, and Singapore.
- Proofpoint observed activity through Sept. 8, with a peak on Sept. 2–3 before Chrome’s patch release. It had directly observed fewer than 20 targeted organizations and said the actual number may be higher.
Article Details
- Attack Vectors
- A three-zero-day exploit chain targeted Chrome, Chromium-based browsers, and Windows, enabling browser-sandbox code execution, sandbox escape, and system-privilege access.
- APT31 used phishing emails containing lures with the exploit-chain loader to target NGOs, mining companies, and commodity trading firms in the United States.
- The phishing link installed a malicious browser extension disguised as Google Gemini. The extension enabled browser-activity surveillance, credential theft, and command execution.
- UNK_DoubleCheck targeted Vietnamese manufacturing organizations with emails sent from a compromised Southeast Asian government account.
- Defensive Notes
- Apply available patches for the identified browser and Windows vulnerabilities; the article reports exploitation before patches were publicly available.
- Ensure Chromium-based browsers are updated, since the article reports that publicly available browsers were not yet patched even though fixes were present in Chromium source code.
MITRE ATT&CK
T1055 · Process InjectionThe chain escaped the browser sandbox and gained system privileges to access the targeted machine.T1056.003 · Web Portal CaptureThe installed extension was reported to steal credentials.T1059 · Command and Scripting InterpreterThe malicious extension enabled attackers to execute commands.T1114 · Email CollectionThe installed extension enabled attackers to surveil browser activity.T1176 · Software ExtensionsA phishing link installed a malicious browser extension disguised as Google Gemini.T1189 · Drive-by CompromiseThe BlueMoon chain exploited vulnerabilities in Chrome and Chromium-based browsers to execute code in the browser sandbox.T1203 · Exploitation for Client ExecutionThe exploit chain used browser vulnerabilities for client-side code execution.T1566.001 · Spearphishing AttachmentAPT31 used phishing emails with lures containing the exploit-chain loader.
CVE
People
Threat Actors
APT31The article identifies APT31 as another name for TA412 and reports its use of the BlueMoon chain in phishing campaigns.TA412Proofpoint-tracked espionage group; the article says it is also known as Violet Typhoon and APT31.UNK_DoubleCheckProofpoint-tracked suspected espionage-motivated group reported targeting Vietnamese manufacturing organizations.UNK_LateNightProofpoint-tracked China-aligned espionage group reported targeting U.S. aerospace companies.UNK_QuietRacketProofpoint-tracked China-aligned espionage group reported targeting government, consulting, and financial organizations in Indonesia and Singapore.Violet TyphoonThe article identifies Violet Typhoon as another name for TA412.
Vendors
Products
ChromiumProofpoint found at least four China-aligned threat groups chaining three zero-day flaws in Chrome, Chromium-based browsers, and Windows to carry out espionage since late August.Google ChromeProofpoint found at least four China-aligned threat groups chaining three zero-day flaws in Chrome, Chromium-based browsers, and Windows to carry out espionage since late August.Google GeminiThe phishing link installed a malicious browser extension disguised as Google Gemini on targeted machines, enabling attackers to surveil browser activity, steal credentials and execute commands, according to Proofpoint.Microsoft WindowsThe BlueMoon chain targets Chrome, Chromium-based browsers, and Microsoft Windows.
Tools
Countries
Indonesiaaerospace companies, and organizations in Vietnam, Indonesia, and Singapore.Singaporeaerospace companies, and organizations in Vietnam, Indonesia, and Singapore.United Statesemails targeting non-governmental organizations, mining companies and commodity trading firms in the United States.Vietnamaerospace companies, and organizations in Vietnam, Indonesia, and Singapore.
Industries
Aerospaceaerospace companies, and organizations in Vietnam, Indonesia, and Singapore.Commodity tradingchain loader in phishing emails targeting non-governmental organizations, mining companies and commodity trading firms in the United States.ConsultingOther groups targeted aerospace, manufacturing, government, consulting, and financial organizations across Asia.GovernmentOther groups targeted aerospace, manufacturing, government, consulting, and financial organizations across Asia.ManufacturingOther groups targeted aerospace, manufacturing, government, consulting, and financial organizations across Asia.MiningThe BlueMoon exploit chain has been used against NGOs, mining and commodity firms, U.S.