Four state-sponsored hacking groups acquired the BlueMoon exploit kit within twelve days of each other, according to Proofpoint research. The kit chains two Chrome vulnerabilities with a Windows kernel flaw to compromise fully updated browsers and the machines running them. Volexity, a threat intelligence firm, identified a fifth operator using the same toolkit days later.
Proofpoint first detected BlueMoon on August 28, 2026 in spearphishing attacks attributed to TA412, a China-aligned group also known as JungleBamboo and APT31, targeting US nonprofits, mining companies, and commodity traders. Three additional clusters followed: UTA0560 using donation lures, UNK_LateNight striking aerospace firms, and UNK_QuietRacket hitting government and financial targets in Indonesia and Singapore.
The kit exploits CVE-2026-85046 and CVE-2026-87491 in Chrome’s V8 engine, plus CVE-2026-85880, a Windows privilege escalation zero-day. Both Chrome flaws were publicly fixed in Chromium source code but hadn’t reached stable releases yet, creating a four-week window attackers exploited.
Source: Cybersecurity Insiders, Independent CISO Research & Insights — https://www.cybersecurity-insiders.com/bluemoon-zero-day-exploit-kit/