Four Spy Groups Deployed BlueMoon Exploit Kit Targeting Chrome and Windows
State-sponsored actors rapidly exploited vulnerabilities in Chrome and Windows.
1Introduction to BlueMoon Exploit Kit
Multiple espionage-motivated threat clusters have deployed BlueMoon, a previously undocumented exploit kit. It chains vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use was attributed to China-aligned APT31 on August 28, 2026. Proofpoint reported that several other clusters with suspected China ties began using BlueMoon shortly after. Some usage remains unattributed, suggesting broader adoption.
2Vulnerabilities Exploited
BlueMoon exploits CVE-2026-85046 and CVE-2026-85880. Google patched CVE-2026-85046 last week, while Microsoft addressed CVE-2026-85880 in September 2026 Patch Tuesday updates. Both were 'patch-gap' zero-days when exploited. The flaws were fixed in Chromium's upstream source code but hadn't propagated to stable browser releases. The exploit kit developer likely tracked Chromium patches closely to assemble the attack chain.
3Attack Methodology
BlueMoon relies on phishing emails to trick targets into visiting actor-controlled URLs. It triggers two Chrome V8 flaws in succession, achieving code execution and escaping the browser sandbox. It then exploits a Windows local privilege escalation bug to inject shellcode, downloading payloads based on the threat cluster. Proofpoint researchers detailed the use of reflectively loaded DLLs to fingerprint Windows hosts and execute LPE exploits.
4Exploit Kit Variants
Multiple BlueMoon variants have been detected with subtle changes, such as removed comments or obfuscated components. Some variants include campaign-specific landing pages, redirects, browser-side OS checks, or additional telemetry. Despite these modifications, the underlying exploit chain remains consistent. Proofpoint also published detection rules for the kit's JavaScript loader and command-and-control traffic.
5AI-Assisted Development
Extensive logging and verbose comments in BlueMoon's source code suggest AI-assisted development. Repeated references to Google's v8CTF challenge, an exploit-focused VRP and CTF competition, support this theory. It's unclear if the V8 exploits were developed against v8CTF or if this framing was used to bypass LLM guardrails. AI tools may have lowered the cost and barrier to entry for such exploit development.
6Rapid Deployment and Sharing
BlueMoon was developed, deployed, and shared across multiple threat actors within days. This rapid dissemination reflects reduced costs and barriers for such capabilities. AI agents increasingly enable exploit development, particularly for open-source codebases like Chromium. Publicly accessible upstream patches create windows for threat actors to reverse engineer and develop exploits before downstream stable releases.
7CISA's Response
CISA added the Chrome flaw to its Known Exploited Vulnerabilities catalog on September 4, 2026. U.S. federal civilian agencies were given until September 18 to patch. However, updating the browser only closes the entry point; it doesn't remove installed malware. The GemStone extension and scheduled tasks created by threat groups persist post-patch, requiring additional checks.
8Implications and Recommendations
BlueMoon represents a significant escalation in exploit kit capabilities, with rapid deployment and AI-assisted development. Organizations must prioritize identifying exploitable risks, testing new CVEs, and reducing exposure. Proofpoint's detection rules (2071919-2071924) can help mitigate threats. As AI-powered attacks accelerate, proactive measures are essential to stay ahead of evolving threats.