Multiple cyber-espionage groups have deployed an exploit kit dubbed BlueMoon, which leverages zero-day vulnerabilities in Microsoft Windows and Google Chrome. The kit combines two security issues in Chromium-based browsers that enable remote code execution and sandbox escape, with a kernel local privilege escalation flaw in Windows.
Researchers at Proofpoint observed BlueMoon in use since August 28, 2026, in spearphishing operations attributed to the China-linked threat actor JungleBamboo, also known as APT31, Violet Typhoon, or Tide Castle. Separately, Volexity observed similar activity on September 1, 2026, in campaigns from another actor it tracks as UTA0560, which targeted customers at multiple non-governmental organizations (NGOs).
The BlueMoon exploit kit chains three specific vulnerabilities. The first two are in Chrome's V8 JavaScript engine: CVE-2026-85046, a type-confusion flaw that provides arbitrary memory access within the V8 sandbox, and CVE-2026-87491, a V8 sandbox escape that corrupts WebAssembly metadata to execute embedded shellcode. The third vulnerability, CVE-2026-85880, is a heap-based buffer overflow in Windows ALPC that allows for local privilege escalation.
Proofpoint suggests that CVE-2026-85880 was exploited as a classic zero-day, potentially since 2025, and later repackaged into BlueMoon. Evidence supporting this includes a 2025 compilation timestamp on the Local Privilege Escalation (LPE) DLL, which did not appear to be forged, and the exploit's targeting of older Windows builds. This indicates that the exploit creator likely integrated an existing capability into the BlueMoon kit.
The exploit operates within a Web Worker, retrying up to five times. It first fingerprints the system, then exploits the Windows privilege elevation flaw to elevate the Chrome renderer's privileges. Subsequently, it injects into Chrome's parent process to execute an operator-selected command. The default final command uses `curl` to save an executable, typically a malware loader, to the `%TEMP%` directory and then runs it.
Analysis by Proofpoint and Volexity has identified four distinct activity clusters associated with BlueMoon deployments, with three of these described as Chinese or China-aligned. JungleBamboo, a Chinese state-sponsored actor, is known for targeting NGOs in the US, mining companies, and high-value individuals, often using the Longtale/GemStone credential stealer disguised as Google Gemini.
The second group, UTA0560, targeted NGOs using donation-themed lures. Their infection chain delivered Grimwedge, an in-memory JScript backdoor used for reconnaissance, file and process management, command execution, and payload uploads. A third cluster, tracked as UNK_LateNight, has been observed deploying the ShadowPad backdoor on systems belonging to U.S. aerospace and defense-industrial-base companies.
A fourth group, UNK_DoubleCheck, targeted Vietnamese manufacturing firms with an in-memory Rust loader. However, the final payload in these attacks could not be retrieved for analysis.
Researchers note that the BlueMoon developers exploit the delay between public Chromium fixes and stable Chrome releases. They reverse-engineer public code changes to create exploits that target users of downstream browsers.
Proofpoint anticipates an increase in BlueMoon's adoption and deployment, potentially extending to financially motivated attackers in the future. Defenders are advised to utilize the provided indicators of compromise from both reports to proactively block this activity.
