Four spy groups deploy same Chrome and Windows exploit kit within a week

September 9, 2026 at 09:34 PM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

Four espionage-motivated threat clusters deployed a previously undocumented exploit kit called BlueMoon within a week of its first use on August 28, 2026. The kit chains three vulnerabilities in Google Chrome and Microsoft Windows to achieve remote code execution and privilege escalation. Proofpoint attributed the first use to China-aligned APT31, with other clusters showing a suspected China nexus.

Key Facts

BlueMoon chains CVE-2026-85046, an unassigned V8 sandbox escape, and CVE-2026-85880 to compromise Chrome and Windows systems.
APT31 first used BlueMoon on August 28, 2026, and several other espionage clusters adopted it within days.
Google patched CVE-2026-85046 last week, while Microsoft addressed CVE-2026-85880 in its September 2026 Patch Tuesday updates.
Both Chrome V8 vulnerabilities were patch-gap zero-days, fixed in upstream Chromium but not yet in stable browser releases when exploited.
Attack chains begin with phishing emails that lure targets to actor-controlled URLs triggering the exploit sequence.

Exploit Kit Composition

BlueMoon chains three vulnerabilities to compromise targeted systems. CVE-2026-85046 is a type confusion flaw in Google Chrome's V8 engine. A V8 sandbox escape without an assigned CVE identifier follows the initial flaw. CVE-2026-85880 is a heap-based buffer overflow in Windows Advanced Local Procedure Call (ALPC). Google patched CVE-2026-85046 last week, and Microsoft fixed CVE-2026-85880 in September 2026 Patch Tuesday.

Attribution and Adoption

Proofpoint attributed the first in-the-wild use of BlueMoon to China-aligned APT31 on August 28, 2026. Several other espionage-motivated clusters began using BlueMoon within days, most with a suspected China nexus. Proofpoint noted that BlueMoon may not be exclusive to China-aligned actors, as some usage remains unattributed. The developer behind the kit likely tracked public Chromium patches to assemble the browser exploit chain.

Attack Chain Mechanics

Phishing emails trick targets into visiting actor-controlled URLs that trigger the two V8 flaws in succession. The chain achieves code execution and escapes the browser sandbox before exploiting the Windows LPE bug. A reflectively loaded DLL fingerprints the Windows host to decide whether to attempt the LPE exploit. A second DLL runs the LPE exploit to elevate the renderer process, then injects a CreateProcess stub into the Chrome broker process. The default command downloads and executes a remotely hosted executable via curl.