Four Espionage Groups Deploy BlueMoon Exploit Kit

Multiple threat clusters, including the state-sponsored APT31 and three unattributed groups (UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket), have been observed deploying the 'BlueMoon' exploit kit starting in late August 2026. The kit targets a 'patch-gap' window where Chromium fixes were public in upstream source code but not yet deployed to stable browser releases, allowing actors to achieve remote code execution and local privilege escalation.

The attack chain typically begins with spear-phishing that directs victims to malicious URLs. BlueMoon then chains a Chrome V8 type confusion flaw (CVE-2026-85046) with a sandbox escape and a Windows ALPC buffer overflow (CVE-2026-85880). The kit uses reflectively loaded DLLs to fingerprint hosts and elevate privileges before injecting shellcode to download secondary payloads like ShadowPad or the GemStone browser extension.

This activity is significant due to the rapid adoption of a high-value browser exploit chain across multiple distinct actors within days. The presence of verbose logging and references to CTF challenges suggests the exploit's development may have been accelerated using AI tools to bypass guardrails or analyze public patches. Affected sectors include aerospace, NGOs, manufacturing, and government entities across the U.S. and Southeast Asia.