"Within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus," Proofpoint said in a report published today.
What BlueMoon is and which vulnerabilities it chains
BlueMoon is a previously undocumented exploit kit that chains multiple vulnerabilities in Google Chrome's V8 JavaScript engine and Microsoft Windows. The observed exploit chain relies on three specific flaws: CVE-2026-85046, a type confusion in V8 in Google Chrome; an additional V8 sandbox escape that at the time carried no CVE identifier; and CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC).
Proofpoint reported that both V8 vulnerabilities were "patch-gap" zero-days when first exploited: the fixes already existed in public upstream Chromium source code but had not yet propagated to stable Chrome and Chromium-based browser releases. CVE-2026-85046 was patched by Google the week before publication, and Microsoft addressed CVE-2026-85880 as part of its September 2026 Patch Tuesday updates.
How the exploit chain operates in practice
Observed attack chains begin with spear-phishing lures that push victims to actor-controlled URLs. The JavaScript loader hosted at those URLs triggers the two V8 flaws in succession to achieve code execution and escape the browser sandbox. After code execution in the renderer, BlueMoon uses a reflectively loaded DLL to fingerprint the Windows host, and the JavaScript decides whether to attempt the local privilege escalation (LPE).
Proofpoint described the next steps: "A second reflectively loaded DLL runs the LPE exploit to elevate the renderer process. With those additional privileges, a separate injector shellcode injects a CreateProcess stub into the parent Chrome broker process, executing an operator-specified command. The default command downloads a remotely hosted executable via a curl command and executes it."
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageWho used BlueMoon and the timelines observed
- APT31 — Beginning August 28, 2026: Spear-phishing targeting NGOs, mining companies, and physical commodity trading firms in the U.S. BlueMoon downloaded a loader that installed a browser add-on disguised as Google Gemini via a Chrome extension integrity bypass named GhostChrome-X. The extension, tracked as GemStone, provided surveillance and credential-theft backdoor functionality and a command-and-control channel.
- UNK_LateNight — Beginning September 2, 2026: A China-aligned cluster that targeted multiple U.S. aerospace companies and used BlueMoon to deploy the ShadowPad backdoor via DLL sideloading.
- UNK_DoubleCheck — Beginning September 2, 2026: Targeted a Vietnamese manufacturing entity; BlueMoon delivered a DLL sideloading chain that dropped a Rust binary which fetched a second DLL via a Cloudflare R2 Bucket.
- UNK_QuietRacket — Beginning September 3, 2026: A China-aligned actor that targeted government, consulting, and financial organizations in Indonesia and Singapore. In this variant BlueMoon downloaded a DLL sideloading pair; the rogue DLL contacted Cloudflare Workers domains to obtain and run a .NET assembly in memory and create a scheduled task for persistence.
Techniques, persistence, and signs of AI-assisted development
Proofpoint noted numerous variants of BlueMoon with small modifications — removed comments, obfuscation, campaign-specific landing pages, OS checks and telemetry — but the same underlying chain. Source artifacts contained extensive logging and verbose comments, which led researchers to say the tool "may have been developed with assistance using artificial intelligence (AI) tools." Proofpoint also documented repeated references to the v8CTF challenge and said it was "currently unknown if the V8 exploits were genuinely developed against the v8CTF bug bounty framework, or if this framing was used by the exploit developers to bypass large language model (LLM) guardrails."
Detection, mitigation, and observable indicators
CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on 4 September, giving U.S. federal civilian agencies until 18 September to patch. Proofpoint emphasized that updating browsers closes the exploitation vector but "does not remove anything already installed." Observables to check include:
- Process tree: chrome.exe → cmd.exe → curl.exe → msgbox.exe
- Files: ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder
- Folder: C:\Users\Public\stomp_ext
- Scheduled tasks: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup or GeForceService
- Mutex: Dataupcheckinfo
- Registry key: HKCU\SOFTWARE\Classes\CLSID\{{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}}\InprocServer32
Proofpoint also published JavaScript loader and C2 detection rules numbered 2071919 through 2071924.
What this means for security teams, U.S. federal civilian agencies, and targeted enterprises
- Security teams: Verify browser versions against upstream Chromium patches, hunt for the listed process trees, files, folders, scheduled tasks, mutex, and registry key, and deploy Proofpoint's provided detection rules where possible.
- U.S. federal civilian agencies: Patch timelines are explicit — CISA's KEV entry on 4 September gave agencies until 18 September to patch the Chrome vulnerability — but agencies must also hunt for post-exploitation artifacts that persist after a browser update.
- Targeted enterprises (NGOs, aerospace, manufacturing, consulting, finance): Review spear-phishing defenses and investigate potentially infected endpoints for GemStone extensions, ShadowPad or DLL sideloading indicators, and scheduled tasks that may survive browser patches.
Proofpoint concluded that "A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals." It remains unclear how the kit proliferated so quickly, but the observable artifacts and the CISA KEV entry give organizations concrete steps to find and remediate infections that a browser update alone will not erase.
Source: The Hacker News — Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
