UNK_LateNight

UNK_LateNight is a China-linked cyberespionage activity cluster tracked by Proofpoint under a temporary designation. It was observed targeting multiple United States aerospace and defense companies beginning on September 2, 2026. Its campaigns use business-to-business correspondence, request-for-quotation messages, and defense-themed procurement inquiries as spearphishing lures that direct recipients to attacker-controlled websites hosting the BlueMoon exploit kit. BlueMoon compromises vulnerable Chromium-based browsers on Windows by chaining V8 code execution and sandbox escape with Windows kernel privilege escalation. The chain fingerprints the host to determine exploit compatibility and injects code into the browser's parent broker process to execute a payload outside the renderer sandbox. UNK_LateNight uses this access to deliver the ShadowPad backdoor through DLL sideloading, with a loader decrypting the payload using AES. The infection establishes persistence through a scheduled task. Its ShadowPad payload steals Firefox profile data, captures network traffic, unhooks network-monitoring functions, and communicates over HTTPS. UNK_LateNight is tracked separately from other espionage clusters using BlueMoon; shared exploit-kit use does not establish that those clusters are aliases or subgroups.