Cybersecurity threat actors have unleashed a powerful exploit kit dubbed “BlueMoon” that combines three critical vulnerabilities to infiltrate systems running Microsoft Windows and Google Chrome. The toolkit leverages zero-day flaws in Chromium-based browsers, allowing remote code execution and sandbox escape, along with a kernel local privilege escalation in Windows. This potent combination has been used by multiple cyber-espionage groups since August 28.
Researchers at Proofpoint have tracked the BlueMoon exploit kit’s deployment across distinct operations attributed to the JungleBamboo (also known as APT31 or Violet Typhoon) threat actor, which is associated with China. Cybersecurity and threat intelligence company Volexity has also observed similar activity on September 1st in campaigns from another actor it tracks as UTA0560. This group targeted customers at multiple non-governmental organizations (NGOs).
The BlueMoon exploit kit’s effectiveness lies in its ability to chain three critical vulnerabilities: CVE-2026-85046, a type-confusion flaw in Chrome’s V8 JavaScript engine; CVE-2026-87491, a V8 sandbox escape that corrupts WebAssembly metadata; and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC. Proofpoint suggests that the attackers exploited CVE-2026-85880 as a zero-day vulnerability, which has been in existence since 2025.
The BlueMoon exploit kit operates by running the attack inside a Web Worker, retrying it up to five times. It fingerprints the system, exploits the Windows privilege elevation flaw to elevate the Chrome renderer, and injects into Chrome’s parent process to run an operator-selected command. The default final command uses curl to save an executable, typically a malware loader, under %TEMP% and run it.
Researchers have identified four distinct activity clusters associated with BlueMoon deployments, three of which are described as Chinese or China-aligned. JungleBamboo is known for targeting NGOs in the US, mining companies, and individual high-value targets using credential stealer extensions disguised as Google Gemini. UTA0560 targeted NGOs using donation lures and triggered an infection chain that delivered Grimwedge, an in-memory JScript backdoor.
While threat groups have been observed using BlueMoon, cybersecurity experts warn that its adoption and deployment will likely increase, potentially reaching financially motivated attackers in the future. As a result, defenders are advised to use the provided indicators of compromise in both reports to block the activity early. By staying vigilant and proactive, organizations can minimize their exposure to these sophisticated attacks.
In light of this development, it’s essential for security teams to prioritize patching and updating software regularly, particularly Chromium-based browsers and Windows systems. Moreover, using web application firewalls (WAFs) and intrusion detection/prevention systems (IDS/IPS) can help detect and prevent BlueMoon attacks. By staying informed and taking proactive measures, organizations can reduce their risk of falling victim to these advanced threats.
Source: Bleeping Computer — 2026-09-10