BlueMoon Exploit Kit Rapidly Adopted by Four Hacking Groups, Proofpoint Warns

A single piece of attack code designed to chain three unpatched vulnerabilities in Chrome and Windows has fallen into the hands of at least four separate hacking crews within days of its creation. Researchers at cybersecurity firm Proofpoint have dubbed the toolkit BlueMoon exploit kit, and they confirm it has already been deployed against U.S. nonprofits, aerospace contractors, a Vietnamese manufacturer, and organizations across Singapore and Indonesia — a dispersion pattern suggesting the tool moved from a single developer to multiple threat groups almost immediately after it was built.

Key Takeaways

• Proofpoint identified the BlueMoon exploit kit in use by at least four hacking groups, some linked to Chinese state interests, beginning around August 28.
• The kit chains two Chromium V8 flaws with a Windows kernel privilege escalation bug to install attacker-chosen malware.
• All three vulnerabilities — tracked as CVE-2026-85046, a Chromium V8 sandbox escape, and CVE-2026-85880 — received patches within roughly 24 hours of disclosure.
• Targets span U.S. NGOs, mining and aerospace firms, a Vietnamese manufacturer, and entities in Singapore and Indonesia.
• The attacks exploited a Chromium patch gap between public source fixes and their rollout into stable Chrome and Edge releases, a window researchers say AI-assisted analysis may have helped attackers close faster.

Active Use of BlueMoon Exploit Kit by Multiple Hacking Groups

At least four distinct hacking groups deployed a nearly identical version of the BlueMoon exploit kit, according to Proofpoint, with some of those groups tied to Beijing’s intelligence apparatus. That represents an unusually crowded field for a single exploit chain — fully weaponized Chrome attacks have historically remained in the hands of one or two well-resourced operators, not four simultaneously.

China-Aligned Groups Among Attackers

Proofpoint traced the first wave of attacks to TA412, a China-aligned state-sponsored actor the U.S. government formally indicted in 2024 for acting on behalf of China’s civilian foreign intelligence service. That activity began on August 28. A second China-linked group, UNK_LateNight, targeted U.S. aerospace companies, while UNK_DoubleCheck and UNK_QuietRacket rounded out the list of known operators using the same toolkit.

Targets Span U.S., Southeast Asia, and Strategic Industry Sectors

The victim list reads like a cross-section of strategic industries rather than a single vertical. TA412 hit NGOs, mining companies, and physical commodity trading firms inside the U.S. UNK_LateNight went after aerospace contractors. UNK_DoubleCheck targeted a Vietnamese manufacturing entity, and UNK_QuietRacket focused on Singapore and Indonesia. Proofpoint said it remains unclear whether other, still-unidentified groups also obtained access to the kit — a detail that leaves the true scope of exposure somewhat open-ended.

Technical Composition and Exploited Vulnerabilities of BlueMoon

BlueMoon works by stringing together three separate bugs into one attack path: two flaws in Chromium’s V8 JavaScript engine, followed by a Windows kernel privilege escalation. Once chained, the exploit lets attackers run remote code inside a browser and then escalate to full system control on the underlying machine.

Chaining Chromium V8 and Windows Kernel Flaws

The first V8 flaw, tracked as CVE-2026-85046, is a type-confusion bug that gives attackers arbitrary memory access inside the browser’s sandbox. Paired with it is a second V8 issue, a sandbox escape that corrupts WebAssembly metadata to run embedded shellcode — Google doesn’t assign CVE numbers to V8 sandbox escapes, so this flaw has no separate CVE identifier. Once code execution is achieved inside the browser, the attackers pivot to CVE-2026-85880, a local privilege escalation vulnerability in older versions of Windows, letting the malicious code run with full system rights.

Vulnerabilities Identified and Patched Recently

All three bugs exploited by BlueMoon have been patched within roughly 24 hours of Proofpoint’s disclosure. The Windows flaw was addressed as part of Microsoft’s September 2026 Patch Tuesday release. The affected Windows versions include Windows 10’s October 2018 Update, Windows 10 version 2004, Windows Server 2019, Windows Server 2022, and the initial release of Windows 11 — a spread that covers systems many organizations are still running years after their original release.

Rapid Spread Fueled by Chromium Patch Gap and AI-Driven Discovery

BlueMoon’s speed and visibility are what make it stand out. Most espionage-grade browser exploits are used sparingly and kept quiet on purpose, because burning a rare zero-day fast shortens its useful life. BlueMoon did the opposite: it was built, deployed, and shared across multiple threat actors within days, despite leaving detection signals that made it easy to spot.

Exploiting Delays in Browser Patch Deployment

Proofpoint pointed to the Chromium patch gap as a likely driver of that urgency. Chromium is open source, meaning fixes land in the public codebase before they’re incorporated into stable releases of Chrome, Edge, and other Chromium-based browsers. That gap gives attackers a window to reverse-engineer the published fix and build a working exploit before most users actually receive the patched browser.

“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said, noting they were already fixed upstream but still exploitable in the latest stable Chrome and Chromium-based browsers available to the public.

AI Lowers Barriers to Exploit Development

The other likely factor is speed of discovery itself. Proofpoint suggested that AI vulnerability discovery tools can spot exploitable flaws faster than manual human analysis alone, shrinking the time between a patch appearing in public source code and a working exploit chain going live.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development.”

That combination — an open-source patch gap plus AI-accelerated reverse engineering — has implications well beyond this one kit. If high-value browser exploit chains can now be built and shared across multiple threat actors within days rather than months, the economics of cyber espionage shift. Capabilities that used to be scarce and closely guarded by top-tier state actors could become more accessible to a wider range of groups, including financially motivated ones, well before defenders finish rolling out patches everywhere they’re needed.

Proofpoint warned that despite the visibility of the attacks and the fact that all three flaws are now fixed, BlueMoon may not disappear quietly.

“Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers,” the researchers said

— a reminder that patch availability and patch adoption are two very different things, and the gap between them is exactly what BlueMoon was built to exploit.

Frequently Asked Questions

What is the BlueMoon exploit kit?

BlueMoon is an exploit kit that chains three vulnerabilities in Chromium-based browsers and older Windows versions to install malware of the attacker’s choosing.

Which vulnerabilities does BlueMoon exploit?

It exploits two Chromium V8 engine vulnerabilities — including a type confusion bug tracked as CVE-2026-85046 — and a Windows kernel local privilege escalation tracked as CVE-2026-85880.

Who are the known attackers using BlueMoon?

At least four hacking groups, including China-aligned state-sponsored actors such as TA412 and UNK_LateNight, are using BlueMoon, according to Proofpoint.

Are patches available to protect against BlueMoon?

Yes, all three vulnerabilities exploited by BlueMoon were patched within the past 24 hours of disclosure, but browser and system patch adoption is still catching up across affected organizations.