BlueMoon Exploit Kit Rapidly Adopted by Espionage Groups

Beginning in late August 2026, Proofpoint identified the rapid adoption of a novel exploit kit dubbed 'BlueMoon' by at least four espionage-motivated threat actors, including the China-aligned TA412 (APT31). The kit utilizes a sophisticated 'patch-gap' exploit chain targeting Chromium's V8 engine and a Windows kernel vulnerability. This rapid, multi-actor deployment suggests the kit may be supplied by a shared digital quartermaster or developed using AI assistance, as evidenced by extensive diagnostic logging and handover documentation discovered in the code.

The attack chain leverages two Chromium vulnerabilities (CVE-2026-85046 and a sandbox escape) alongside a Windows kernel Local Privilege Escalation (LPE) vulnerability (CVE-2026-85880). Although the LPE targets older Windows builds, the speed at which these actors weaponized public upstream Chromium patches before stable downstream updates were released highlights a significant 'patch-gap' risk for modern organizations.

Targeted sectors include aerospace, defense, NGOs, mining, and government entities across the U.S., Singapore, Indonesia, and Vietnam. The payloads delivered range from the GemStone browser-surveillance extension to the ShadowPad backdoor, indicating a primary objective of credential theft and long-term espionage.