Proofpoint observed BlueMoon being used since August 28 in spearphishing operations attributed to the JungleBamboo threat actor.
What BlueMoon is and the three CVEs it chains
BlueMoon is an exploit kit that combines two Chromium-based browser vulnerabilities and a Windows kernel local privilege escalation (LPE). The specific flaws chained by the kit are CVE-2026-85046, a type-confusion flaw in Chrome’s V8 JavaScript engine that provides arbitrary memory access inside the V8 sandbox; CVE-2026-87491, a V8 sandbox escape that corrupts WebAssembly metadata to run embedded shellcode; and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC that allows local privilege escalation.
How the kit operates: Web Worker, retries, privilege elevation, and payload fetch
Researchers report BlueMoon executes the browser exploit inside a Web Worker and will retry the exploit up to five times. The kit fingerprints the host, exploits the Windows privilege-elevation flaw to raise the Chrome renderer’s privileges, then injects into Chrome’s parent process to run an operator-selected command. Proofpoint describes the default final command as using curl to save an executable — typically a malware loader — under %TEMP% and run it.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWho used BlueMoon and what was delivered
- Proofpoint observed spearphishing tied to JungleBamboo (also tracked as APT31, Violet Typhoon, Tide Castle) and attributes those campaigns to a China-aligned actor. Proofpoint says JungleBamboo used a Longtale/GemStone credential-stealer extension disguised as Google Gemini in earlier activity.
- Volexity observed similar activity on September 1st from an actor it tracks as UTA0560, which targeted customers at multiple non-governmental organizations (NGOs) and triggered an infection chain that delivered Grimwedge — an in-memory JScript backdoor used for reconnaissance, file and process management, command execution, and payload uploads.
- Two additional clusters were observed deploying BlueMoon: UNK_LateNight, associated with ShadowPad deployments on systems belonging to U.S. aerospace and defense‑industrial‑base companies, and UNK_DoubleCheck, which targeted Vietnamese manufacturing firms with an in‑memory Rust loader whose final payload could not be retrieved for analysis.
Evidence of repackaging and the developer/maintainer behavior
Proofpoint reports that the BlueMoon maintainers exploit the time gap between public Chromium fixes and stable Chrome releases: they reverse‑engineer public code changes and turn them into working exploits targeting downstream browser users. Proofpoint also notes that the CVE-2026-85880 LPE appears to have been repackaged into BlueMoon: the LPE DLL’s compilation timestamp dates from 2025 and “did not appear to be forged,” and the exploit targeted older Windows builds — consistent with a capability developed earlier and folded into the kit.
What this means for NGOs, U.S. aerospace and defense‑industrial‑base companies, and Vietnamese manufacturing firms
- NGOs: UTA0560 used donation lures in campaigns observed by Volexity; organizations that receive public-facing inquiries or donation requests should prioritize indicators of compromise (IOCs) shared by Proofpoint and Volexity to detect an exploitation chain that can deliver an in‑memory backdoor such as Grimwedge.
- U.S. aerospace and defense‑industrial‑base companies: UNK_LateNight activity included ShadowPad deployments on these systems; defenders should treat Chrome-based exploit chains plus a Windows ALPC LPE as a realistic route to persistent, high‑privilege compromise.
- Vietnamese manufacturing firms: UNK_DoubleCheck’s targeting with an in‑memory Rust loader — even when the final payload could not be captured — demonstrates that BlueMoon deployments have reached industrial targets in the region and that in‑memory loaders are part of observed post‑exploitation toolsets.
Both Proofpoint and Volexity have published indicators of compromise for files and network infrastructure observed in BlueMoon operations, and Proofpoint warns that adoption of BlueMoon is likely to increase and could spread beyond state‑aligned actors to financially motivated attackers.
Proofpoint also emphasizes a practical point echoed in their reporting: overall prevention scores can obscure what happens after initial access. Their Blue Report 2026, which measures defenses technique‑by‑technique across 338 million simulations, illustrates how prevention can drop sharply once attackers operate with valid credentials.
BlueMoon’s modular design, its reuse of a likely preexisting Windows LPE, and the maintainers’ deliberate exploitation of release timing in Chromium updates combine into a practical threat: the kit converts recently disclosed browser fixes into exploitable code for downstream users before many browser installations are updated. The immediate question left by the observed activity is whether the kit’s documented modularity and accessible IOCs will accelerate reuse by other groups — including financially motivated actors — and how quickly defenders can use the shared indicators to break these attack chains.
Source: BleepingComputer — New 'BlueMoon' kit exploited Windows and Chrome zero‑day flaws
