BlueMoon Exploit Kit Gives Four Espionage Groups a Shared Chrome-to-Windows Attack Chain

Four threat clusters have deployed a previously undocumented exploit kit that chains two Google Chrome/V8 flaws with a Microsoft Windows privilege-escalation vulnerability.

Named BlueMoon, the kit converts a spear-phishing link into code execution inside Chrome, escapes the browser sandbox, elevates privileges on Windows, and installs an operator-selected payload. Exploitation was first observed on August 28, 2026, in activity attributed to the China-aligned group APT31.

Three other clusters began using substantially the same tooling within days. The rapid distribution of a complete browser exploit chain suggests that capabilities once reserved for a small number of well-resourced operators may be becoming easier to share and modify.

Four clusters adopted BlueMoon within one week

APT31 began using BlueMoon on August 28, 2026, against U.S.-based non-governmental organizations, mining companies, and physical commodity trading firms. The state-sponsored actor is also tracked as TA412, Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, Tide Castle, and Violet Typhoon.

The U.S. government indicted the group in 2024 over activity allegedly conducted for China’s civilian foreign intelligence agency, according to reporting on the BlueMoon campaigns.

Two more clusters, UNK_LateNight and UNK_DoubleCheck, adopted the kit on September 2, 2026. UNK_LateNight targeted several U.S. aerospace companies and delivered ShadowPad through DLL sideloading. It is assessed to be a China-aligned espionage operation.

UNK_DoubleCheck targeted a Vietnamese manufacturing organization through an attacker-controlled Cloudflare Workers domain. BlueMoon launched a sideloading chain that dropped a Rust executable, which then contacted a Cloudflare R2 bucket and retrieved another DLL-sideloading pair. Its national affiliation has not been established.

UNK_QuietRacket began operating BlueMoon on September 3, 2026. This China-aligned cluster targeted government, consulting, and financial organizations in Indonesia and Singapore. Its modified kit obtained a rogue DLL through Cloudflare Workers infrastructure and executed a .NET assembly in memory. The payload established persistence through a scheduled task.

Most observed activity therefore has a suspected Chinese nexus, but the kit is not necessarily exclusive to China-aligned operators. How the four clusters acquired it remains unknown, and other users may exist.

Two Chrome flaws open the route out of the sandbox

The browser stage begins with CVE-2026-85046, a high-severity type-confusion vulnerability in Chrome’s V8 JavaScript engine. It has a CVSS score of 8.8 and can provide arbitrary code execution inside the browser sandbox when a user visits a crafted HTML page.

The affected versions are:

• Google Chrome before 152.0.7977.82
• Google V8 before 15.3.48

BlueMoon follows that initial compromise with a separate V8 vulnerability that escapes the renderer sandbox. This second browser flaw has no CVE identifier because Google does not assign CVEs to V8 sandbox escapes. Exact standalone affected-version ranges for it have not been disclosed.

Both V8 issues were reportedly patch-gap zero-days during the attacks. Fixes were already visible in public upstream Chromium source code, but they had not yet reached the latest stable Chrome and Chromium-based browser releases.

That interval exposed defenders to a distinct supply-chain timing problem. Attackers could examine public code changes, identify the corrected security defect, and reverse-engineer an exploit before most users received the corresponding stable update.

CVE-2026-85046 entered CISA’s Known Exploited Vulnerabilities catalog on September 4, 2026. U.S. federal civilian agencies have a remediation deadline of September 18, 2026.

Windows ALPC flaw completes the compromise

After escaping Chrome’s sandbox, BlueMoon loads a DLL reflectively to fingerprint the Windows host. JavaScript logic then decides whether the system is suitable for the final privilege-escalation stage.

The kit uses CVE-2026-85880, a heap-based buffer overflow in Windows Advanced Local Procedure Call. The vulnerability has a CVSS score of 7.8 and allows an attacker who already has local access to elevate privileges without further user interaction.

The affected Windows releases and vulnerable build ranges are:

• Windows 10 1607 before 10.0.14393.9512
• Windows 10 1809 before 10.0.17763.9245
• Windows 10 21H2 before 10.0.19044.7725
• Windows 10 22H2 before 10.0.19045.7725
• Windows Server 2012, for which no build threshold is available
• Windows Server 2016 before 10.0.14393.9512
• Windows Server 2019 before 10.0.17763.9245
• Windows Server 2022 before 10.0.20348.5622

BlueMoon reflectively loads a second DLL containing the ALPC exploit and elevates the Chrome renderer process. Injector shellcode then places a CreateProcess stub inside the parent Chrome broker process, allowing the operator to run an arbitrary command.

The default command invokes curl to download and execute a remotely hosted program. The final malware depends on the cluster running the campaign.

CVE-2026-85880 entered the KEV catalog on September 8, 2026, with a federal remediation deadline of September 22, 2026. Microsoft addressed the issue through its September 2026 Patch Tuesday updates.

The two BlueMoon flaws are part of a broader run of Google and Microsoft vulnerabilities entering KEV. During the previous 90 days, CISA also added CVE-2026-81963, CVE-2019-1068, CVE-2026-33824, CVE-2026-55040, CVE-2026-68820, and CVE-2026-50522 for those vendors.

Payloads range from browser surveillance to ShadowPad

APT31’s BlueMoon chain downloads a loader that installs a malicious Chrome extension presented as Google Gemini. The loader uses the GhostChrome-X extension-integrity bypass to deploy GemStone, a browser-surveillance and credential-theft backdoor controlled through a command-and-control channel.

The other clusters favor DLL sideloading. UNK_LateNight installs ShadowPad, while UNK_DoubleCheck uses a Rust component and staged payload retrieval from Cloudflare R2. UNK_QuietRacket combines sideloading, in-memory .NET execution, and scheduled-task persistence.

BlueMoon itself has also appeared in several variants. Operators have removed source-code comments, obfuscated components, added operating-system checks, changed landing pages and redirects, and expanded telemetry collection. The core sequence remains unchanged: renderer exploitation, sandbox escape, and Windows privilege escalation.

Spear-phishing is the common entry point. Targets receive links leading to attacker-controlled pages that silently serve the JavaScript exploit chain, meaning exploitation still requires the recipient to open the malicious page.

AI-assisted development is plausible but unconfirmed

Researchers found extensive logging, unusually verbose source-code comments, and repeated references to Google’s v8CTF challenge in associated artifacts. Those characteristics led to an assessment that generative AI tools may have assisted BlueMoon’s development.

That conclusion is not confirmed. The developers may have worked against material associated with the V8-focused challenge, used an AI system to generate or refine code, or inserted references intended to bypass model guardrails.

The more consequential finding is operational: four distinct clusters obtained a working multi-stage exploit chain within days. Weaponized browser chains have traditionally been costly and closely held because they require both a renderer exploit and a reliable sandbox escape.

AI-assisted analysis could lower that barrier, especially for open-source projects where security patches become visible upstream before reaching stable downstream products. Public patches alone, however, do not prove that AI was involved.

Patching must be followed by forensic triage

Organizations should update Chrome to at least 152.0.7977.82 and V8 to at least 15.3.48. Administrators must also bring affected Windows systems to the applicable fixed build.

Because both assigned vulnerabilities are in KEV, they should be treated as active-exploitation priorities. CISA requires covered agencies to apply vendor mitigations under BOD 26-04, follow its forensic-triage requirements, assess internet exposure, and discontinue affected products if no mitigation is available.

A browser update prevents the initial exploit but does not remove malware or persistence already installed. Investigators should search for this process chain:

chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe

Additional indicators include:

• %TEMP%\ChromeUpdate.exe
• %TEMP%\msgbox.exe
• C:\Users\Public\stomp_ext
• Mutex Dataupcheckinfo
• Scheduled tasks EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, and GeForceService
• Registry key HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32

Security teams should also examine unauthorized Chrome extensions, DLL-sideloading activity, Cloudflare Workers or R2 retrieval, in-memory .NET execution, and evidence of GemStone or ShadowPad. Detection rules 2071919 through 2071924 cover BlueMoon’s JavaScript loader and command-and-control traffic.

Patching closes the exposed vulnerabilities. It does not finish the incident response.