A Highly Sophisticated Exploit Kit is Being Rapidly Deployed by Multiple Espionage Groups
A new exploit kit called BlueMoon has been discovered being used by multiple espionage groups to target organizations in various industries, including aerospace, government, and finance. This kit is particularly concerning due to its ability to chain together three previously unpatched vulnerabilities: two zero-days in Google’s Chrome browser and one in Windows. The ease with which this exploit kit can be adopted has raised concerns that it may soon be used by financially motivated threat actors as well.
The BlueMoon exploit kit was first spotted being used by the China-linked APT Violet Typhoon (also known as APT31, JungleBamboo, TA412, and Tide Castle) on August 28. Within days, several other Chinese threat actors started using it, but it’s likely that this activity is not exclusive to China-aligned groups. Proofpoint, a cybersecurity firm, notes that it’s currently unknown how multiple distinct threat actors obtained access to the exploit kit.
The BlueMoon exploit kit works by chaining together three vulnerabilities: two zero-days in Chrome (CVE-2026-85046 and CVE-2026-87491) and one in Windows (CVE-2026-85880). These flaws were patched as zero-days on September 3 and September 8, respectively. The Chrome vulnerabilities impact the V8 JavaScript and WebAssembly engine, while the Windows flaw is a privilege escalation in Windows Advanced Local Procedure Call (ALPC).
Once the BlueMoon exploit kit gains access to a system, it exploits the V8 defects for sandbox escape, then fingerprints the host and executes the privilege escalation code. Next, a CreateProcess stub is injected into the parent Chrome broker process to download an executable via a curl command and execute it.
What’s particularly concerning about this exploit kit is its rapid deployment and adoption by multiple threat actors. Proofpoint notes that the creators of BlueMoon may have used AI to build it, although no single artifact conclusively confirms this. The fact that development artifacts suggest AI involvement raises questions about the future of threat actor capabilities and the potential for even more sophisticated exploits.
The BlueMoon exploit kit has been used in attacks targeting NGOs in the US, mining entities, physical commodity trading firms, US aerospace companies, government, consulting, and financial entities in Indonesia and Singapore. This highlights the need for organizations to be vigilant and ensure that their systems are up-to-date with the latest patches.
In light of this discovery, it’s essential for organizations to prioritize patching their systems, especially if they’re using Chrome or Windows. Regularly updating software and running security scans can help prevent exploitation by kits like BlueMoon. Additionally, being aware of the potential for AI-generated exploits and staying informed about the latest threats and trends is crucial in today’s cybersecurity landscape.
Source: SecurityWeek — 2026-09-12