Red Hot Cyber
Cybersecurity, Cybercrime News and Vulnerability Analysis
Proofpoint researchers have discovered a new BlueMoon exploit kit that combines three vulnerabilities in Chrome and Windows into a single chain. According to experts, the tool was obtained almost simultaneously by at least four espionage groups, most of which are linked to China.
BlueMoon exploits two bugs in the V8 JavaScript engine of the browser, as well as a privilege‑escalation vulnerability in Windows. Initially, the attackers use a recently patched type‑confusion bug in V8 (CVE-2026-85046) to execute arbitrary code, then exploit another recent vulnerability (CVE-2026-87491) to bypass V8’s sandbox. Afterwards, the bug CVE-2026-85880 in the Windows ALPC mechanism is leveraged to elevate privileges.
After a successful exploit, BlueMoon injects code into Chrome’s parent process and executes the command specified by the operators. By default, the exploit kit uses curl to download an executable file into the %TEMP% folder and run it.
The first attacks using BlueMoon were detected as early as August 28, 2026. At that time, the group TA412 (also known as JungleBamboo, Violet Typhoon and APT31), linked to China, attacked U.S. non‑governmental organizations, mining companies, and firms that trade raw materials.
Within days, the same exploit set was used by other hackers. Specifically, the group UNK_LateNight employed BlueMoon against U.S. aerospace companies, delivering the backdoor ShadowPad onto infected systems. Another group, UNK_DoubleCheck, attacked a manufacturing company in Vietnam, while UNK_QuietRacket targeted governmental, financial, and consulting organizations in Indonesia and Singapore. Experts have not yet linked UNK_DoubleCheck to a specific country, but the other groups are tied to China.
Experts note that the most unusual aspect is BlueMoon’s rapid spread. Typically, full exploit chains for Chrome are considered expensive, rare tools used in targeted attacks. However, in BlueMoon’s case, the same exploit set appeared within days in the hands of multiple hacker groups.
Researchers believe that BlueMoon’s successful attacks were facilitated by the so‑called “patch gap”: this term refers to the period when a patch is already present in the project’s code but has not yet reached end users. Fixes first appear in Chromium’s open‑source code and are only later incorporated into the stable releases of Chrome, Edge and other browsers. Consequently, attackers have time to study the patch, perform reverse engineering, and prepare the exploit while the vulnerability remains unpatched on users’ devices.
In the case of CVE-2026-85046, the fix appeared in the source code as early as August 7, but the patch reached Chromium’s stable version only on September 3. The researchers’ report emphasizes that both V8 vulnerabilities were 0‑day at the time of BlueMoon’s attacks, even though the fixes were already present in the project’s code.
Experts also hypothesize that BlueMoon’s development may have been accelerated by artificial‑intelligence agents. The malware code contains detailed diagnostic logs, comments describing debug iterations, and a reference to a markdown file for context transfer between sessions.
According to experts, BlueMoon will continue to spread and over time may enrich the arsenals of financially motivated groups.
