Four Spy Groups Used the Same Chrome and Windows Exploit Kit

A previously unknown exploit kit called BlueMoon has been used by at least four separate espionage groups—most with a suspected China nexus—to compromise targets ranging from U.S. nonprofits to Southeast Asian government agencies. Security firm Proofpoint published a detailed report on September 10 documenting the kit and its rapid adoption across multiple threat clusters.

BlueMoon chains three vulnerabilities together: CVE-2026-85046 (a type confusion flaw in Chrome’s V8 JavaScript engine), CVE-2026-87491 (a V8 sandbox escape), and CVE-2026-85880 (a heap-based buffer overflow in the Windows Advanced Local Procedure Call subsystem). The attack starts with a spear-phishing email that tricks the victim into clicking a link. Visiting the URL triggers the two Chrome bugs in sequence—achieving code execution inside the browser and then escaping the browser sandbox—before the Windows flaw elevates privileges to inject shellcode into the Chrome broker process. That shellcode downloads and runs payloads specific to each threat group.

Both Chrome vulnerabilities were “patch-gap” zero-days: fixes had already been committed to Chromium’s public source code but had not yet reached stable Chrome releases when they were exploited. Proofpoint suspects the attackers monitored publicly visible Chromium patches to build their exploit chain ahead of the stable release. Google patched CVE-2026-85046 last week and CVE-2026-87491 on September 8; Microsoft addressed CVE-2026-85880 in its September 2026 Patch Tuesday update.

APT31 (also tracked as Violet Typhoon and Judgment Panda) was the first group observed using BlueMoon, starting August 28. Its campaign targeted U.S. NGOs, mining companies, and commodity trading firms, ultimately deploying a browser-surveillance backdoor called GemStone disguised as a Google Gemini extension using a technique Proofpoint calls GhostChrome-X. Three other clusters—UNK_LateNight (targeting U.S. aerospace, deploying ShadowPad), UNK_DoubleCheck (targeting Vietnamese manufacturing), and UNK_QuietRacket (targeting government and financial sectors in Indonesia and Singapore)—adopted the same kit within days. CISA has added all three CVEs to its Known Exploited Vulnerabilities catalog.

Proofpoint notes the exploit kit shows signs of AI-assisted development, and warns the tool is likely to spread further as more threat actors—including financially motivated ransomware groups—discover it.

How to check if you’re affected

Affected products are Chrome and Chromium-based browsers (Edge, Brave, Opera) on versions released before September 8, 2026, and Windows versions before the September 2026 Patch Tuesday update. Update Chrome and apply the latest Windows security updates immediately.

Patching closes the delivery path, but does not remove implants already installed. If your organization could be a target of Chinese espionage (government, aerospace, NGOs, financial sector), also check for these indicators of compromise Proofpoint published:

• Process tree: chrome.exe spawning cmd.exe → curl.exe → msgbox.exe
• Files: ChromeUpdate.exe or msgbox.exe in the Windows %TEMP% folder
• Folder: C:\Users\Public\stomp_ext
• Scheduled tasks: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, or GeForceService
• Mutex: Dataupcheckinfo
• Registry key: HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32

Proofpoint detection rules are available under Signature IDs 2071919 through 2071924.

Sources

• Proofpoint threat intelligence — Once BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit
• The Hacker News — Four Spy Groups Used the Same Chrome and Windows Exploit Kit