State-Aligned Actors Use BlueMoon Exploit Kit

Beginning in late August 2026, Proofpoint identified a rapid adoption of a novel exploit kit dubbed 'BlueMoon' by multiple state-aligned threat actors. The kit primarily targets users of Chromium-based browsers on older Windows builds. The initial adopter was the China-aligned TA412 (APT31), followed closely by other clusters including UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket. The speed of adoption across distinct groups suggests a shared commercial procurement chain or digital quartermaster.

The technical exploit chain utilizes two 'patch-gap' vulnerabilities in Chromium (CVE-2026-85046 and a sandbox escape) alongside a Windows kernel Local Privilege Escalation (CVE-2026-85880). Evidence, such as extensive diagnostic logging and specific handover documentation formats, suggests the possible use of AI agents in the exploit's development or adaptation. Successful exploitation typically triggers a PowerShell or curl-based download of various payloads, including the GemStone browser extension, ShadowPad, and custom Rust-based loaders.

This activity is significant due to the narrowing 'patch-gap' window where publicly available upstream code fixes are weaponized before downstream stable browser updates reach users. The targeting focuses heavily on NGOs, aerospace, defense industrial base, and government sectors across the US and Southeast Asia. Organizations should prioritize patching Chromium-based browsers and auditing for suspicious process trees originating from browser parent processes.