UNK_DoubleCheck

UNK_DoubleCheck is an espionage-focused threat activity cluster tracked by Proofpoint, observed targeting a Vietnamese manufacturing organization beginning on September 2, 2026. Its country of origin and state affiliation have not been established. The cluster used spearphishing messages sent from a compromised Southeast Asian government email account, with a vaccination-appointment lure directing recipients to actor-controlled Cloudflare Workers infrastructure hosting the BlueMoon exploit kit. BlueMoon combines Chromium V8 exploitation and sandbox escape with Windows local privilege escalation to compromise vulnerable Windows systems. Its chain includes CVE-2026-85046 and CVE-2026-85880, and exploits the gap between publicly available upstream Chromium fixes and their deployment in stable browsers. The kit fingerprints the host before attempting privilege escalation and injects code into the parent Chrome broker process to launch subsequent payloads. UNK_DoubleCheck used an obfuscated BlueMoon variant to initiate a DLL-sideloading chain that loaded a Rust executable into memory. The Rust loader subsequently retrieved and executed a second DLL-sideloading pair from Cloudflare R2. Although UNK_DoubleCheck shared BlueMoon with other espionage clusters, including TA412, UNK_LateNight, and UNK_QuietRacket, it is tracked as a distinct activity cluster; shared exploit use does not establish common ownership or national attribution.