BlueMoon Exploit Kit Adopted by Four Spy Groups

Estimated reading time: 5 minutes · Last updated: 9 September 2026

Proofpoint linked in-the-wild exploitation by a previously undocumented exploit kit called BlueMoon to four espionage-focused clusters, including APT31, and traced its chain to two Chrome V8 vulnerabilities and a Windows ALPC flaw. BlueMoon combines a V8 type-confusion bug (CVE-2026-85046), an additional V8 sandbox-escape vulnerability, and a Windows local privilege escalation (CVE-2026-85880) to break out of the browser sandbox, elevate a renderer process, and execute operator commands that download payloads. On 4 September 2026, CISA placed the Chrome vulnerability on its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to remediate by 18 September 2026.

Within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus,

Proofpoint

How BlueMoon chains Chrome bugs to a Windows escalation

BlueMoon combines browser and operating-system flaws into a single attack flow that begins in Chrome and finishes on Windows. The chain starts with two V8 engine bugs: a type-confusion flaw assigned CVE-2026-85046 and a separate sandbox escape that has no public CVE identifier. Those browser flaws are exploited in sequence to achieve arbitrary code execution inside the renderer.

After initial execution, BlueMoon reflectively loads a DLL to fingerprint the host and decide whether to attempt the Windows exploit. A second reflectively loaded DLL runs the ALPC heap overflow, CVE-2026-85880, to elevate the renderer process. With elevated privileges the kit injects a CreateProcess stub into the Chrome broker process and executes a shell command that by default uses curl to download and run an executable supplied by the operator.

Proofpoint’s researchers described multiple loader variants and modest code obfuscation across campaigns, but the exploit chain and the technique to hand control from browser to OS remain consistent between samples.

Who used BlueMoon and which sectors were targeted

Proofpoint attributed the first known use of BlueMoon to APT31 on August 28, 2026; that cluster used spear-phishing lures against NGOs, mining companies, and commodity trading firms in the United States and delivered a loader that installed a Chrome extension named GemStone. GemStone functions as a browser-surveillance and credential-theft backdoor and was distributed via a Chrome extension integrity bypass technique linked to GhostChrome-X.

Within days of APT31’s activity, three additional espionage-motivated clusters began using BlueMoon. Proofpoint tracks them as UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket; their observed targets included U.S. aerospace companies, a Vietnamese manufacturer, and government, consulting and financial organisations in Indonesia and Singapore. Each cluster adapted the final payload and persistence method — from DLL sideloading to scheduled tasks and in-memory .NET assemblies — while retaining the same upstream exploit chain.

Why Proofpoint flags AI and public source code as risk multipliers

Proofpoint highlighted signs that AI tools may have assisted development of BlueMoon, citing verbose comments and extensive logging in source artifacts. Researchers also noted repeated references to Google’s v8CTF challenge, which suggests exploit development either drew on CTF-style examples or used that framing to evade models’ guardrails.

The company argued that public upstream patches for Chromium create a patch-gap window: fixes appear in Chromium source code before they reach stable Chrome releases, and actors with access to those upstream diffs can attempt to reverse-engineer exploits quickly. Proofpoint warned that this dynamic lowers the cost and technical barrier for crafting browser exploit chains, and that availability of open code plus AI-assisted workflows may accelerate reuse across multiple threat clusters.

Detection, persistence and immediate remediation steps

Updating Chrome removes the immediate exploitation vector but does not eliminate persistence that may already be present. Proofpoint listed artifacts defenders should check, including a process tree in which chrome.exe launches cmd.exe, which then runs curl.exe followed by msgbox.exe; files such as ChromeUpdate.exe or msgbox.exe in %TEMP%; and a folder at C:\Users\Public\stomp_ext. Observed scheduled tasks include EdgeCore_AutoUpdate and MicrosoftEdgeUpdatesTaskMachine; Proofpoint also provided a mutex identifier and the registry CLSID the kit uses.

To aid defenders, Proofpoint published detection signatures numbered 2071919–2071924 that cover the JavaScript loader and C2 traffic. Organisations should apply vendor patches, deploy the published detection rules, and hunt for the listed persistence indicators, because those elements will survive a browser update if not removed separately.

How the threat could evolve

The bottom line

BlueMoon illustrates how a compact, well-assembled exploit chain can spread quickly between multiple actors. The kit’s use of upstream Chromium fixes as a source for exploit development, and signals that AI tools may have assisted coding, raise the prospect of faster reuse and wider adoption. Patching Chrome and Windows remains the immediate priority, but organisations should also hunt for installed browser extensions, scheduled tasks and sideloaded DLLs listed in Proofpoint’s indicators because those elements survive updates. Deploying the published detection rules and conducting targeted hunts will be necessary to remove persistence established before patches were applied.

What to watch

• U.S. federal civilian agencies must meet CISA’s patch deadline for the Chrome flaw on 18 September 2026.
• Watch for a Proofpoint follow-up report that may expand attributions or telemetry; no date has been set.