Four hacking groups exploit identical Chrome-Windows vulnerability chain
BlueMoon kit combines 3 patched flaws to install malware across outdated systems
1Multi-group attack campaign
At least four hacking groups, some with ties to China, are actively using the BlueMoon exploit kit targeting both Chromium browsers and Windows systems. The kit chains together three critical vulnerabilities to enable arbitrary malware installation. Security firm Proofpoint identified the coordinated attacks occurring simultaneously across multiple threat actor networks, suggesting possible shared infrastructure or collaboration between groups.
2Technical vulnerability details
BlueMoon exploits two Chromium vulnerabilities and one Windows kernel flaw affecting Windows 10 (2018 Update through 2004), Server 2019/2022, and initial Windows 11 releases. All three vulnerabilities received patches within the past day. The Windows kernel vulnerability (CVE-2023-32456) allows privilege escalation, while the Chromium flaws (CVE-2023-34235 and CVE-2023-34236) enable remote code execution when combined.
3Unusual attack characteristics
Unlike typical stealthy campaigns, these attacks are widespread and visible. Hackers usually conserve new exploits to maximize their lifespan. Proofpoint suggests the groups are aggressively exploiting the 'patch gap' - the window between patch availability and actual user deployment. Chromium's complex supply chain means patches take days to weeks to reach all Chrome/Edge users, creating exploitable windows.
4AI acceleration factor
Researchers note AI tools likely accelerated vulnerability discovery. Machine learning models can analyze code changes and spot potential flaws faster than human researchers alone. This aligns with observed Chinese investments in AI-powered cyber tools. The rapid weaponization of these particular vulnerabilities suggests automated assistance in reverse-engineering patches to develop exploits.
5Enterprise risk assessment
Organizations still running unpatched Windows 10 or older Chromium-based browsers face immediate risk. Microsoft reports 32% of enterprise Windows devices remain on vulnerable versions. For Chromium browsers, the patch gap risk is compounded by extension vulnerabilities that often persist even after core browser updates. Security teams should prioritize patch verification and network segmentation.
6Supply chain implications
The attacks highlight weaknesses in software supply chains. Chromium's open-source nature means security depends on downstream implementers. Google may patch Chromium, but Microsoft, Brave, Opera etc. must independently integrate fixes. This fragmentation creates inconsistent protection timelines. Some enterprise browsers lag behind by weeks despite critical fixes being available.
7Attribution challenges
While some groups show Chinese ties, attribution remains difficult due to shared tool usage. BlueMoon's rapid proliferation suggests either tool leakage or intentional sharing between groups. The Chinese Ministry of State Security has historically supported both independent hacker groups and state-sponsored units, creating plausible deniability while advancing strategic objectives.
8Strategic cybersecurity shift
This campaign signals a shift toward rapid, widespread exploitation of known vulnerabilities before patches deploy. The combination of AI-assisted discovery and supply chain delays creates perfect attack conditions. Organizations must now assume vulnerabilities will be weaponized within hours of patch release, requiring automated update systems and real-time threat monitoring.