Loading malware…
BlueMoon is a shared exploit kit targeting Google Chrome and other Chromium-based browsers on Microsoft Windows. First observed on August 28, 2026, it was rapidly adopted by at least four espionage-focused threat clusters. Its exploitation chain combines two Chromium V8 vulnerabilities with a Windows kernel Advanced Local Procedure Call (ALPC) privilege-escalation vulnerability to execute code, escape browser security boundaries, and obtain elevated privileges.
The kit exploits V8 type confusion and a V8/WebAssembly sandbox escape before invoking its Windows exploitation stage. It reflectively loads a DLL to fingerprint the host and assess compatibility with privilege escalation, then injects shellcode into Chrome’s parent broker process to execute an operator-specified command. Its default configuration uses curl to download and execute an additional payload. The browser exploits were used during a patch gap in which upstream Chromium fixes were publicly available before corresponding stable browser updates reached users.
BlueMoon campaigns use spearphishing links leading to attacker-controlled exploit pages. Lures include internship inquiries, academic conferences, procurement requests, and other target-specific communications; some pages redirect victims to legitimate websites while exploitation proceeds. Observed users include the China-linked TA412, also known as APT31, JungleBamboo, and Violet Typhoon, alongside UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket. Operators have delivered distinct payloads, including the GemStone malicious browser extension, ShadowPad, and Rust-based loader chains. Targets span U.S. nonprofit, mining, commodity-trading, aerospace, and defense organizations, a Vietnamese manufacturer, and government, consulting, and financial organizations in Indonesia and Singapore. BlueMoon provides exploitation and payload execution; subsequent surveillance, credential theft, and persistence depend on the malware installed by each operator.
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
10 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
A single exploit kit, dubbed BlueMoon, chained three Google Chrome and Microsoft Windows zero-days and spread across at least four espionage clusters within days.
These groups utilized the same exploit kit, identified as BlueMoon by cybersecurity firm Proofpoint, to compromise Chrome browsers.
These groups utilized the same exploit kit, identified as BlueMoon by cybersecurity firm Proofpoint, to compromise Chrome browsers.
These groups utilized the same exploit kit, identified as BlueMoon by cybersecurity firm Proofpoint, to compromise Chrome browsers.
+4 more in the app. View in Mallory
21 distinct techniques documented for this family, organized by ATT&CK tactic.
« L’infrastructure était créée le jour même ou dans les jours précédant les campagnes. »
As a result of access to public code changes during that period, attackers were able to assess the fix and develop an exploit to discover the underlying weakness.
The report identifies T1608.001 in its TTP list; actor-controlled domains hosted BlueMoon and payload downloads.
The spoofed websites loaded an additional HTML element via a hidden iframe; "config.html" used the BlueMoon exploit kit to deliver the Chrome-Windows exploit chain.
This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.
APT31, also known as TA412, is the first confirmed user of BlueMoon. The group used it to attack U.S. non-governmental organizations, mining companies, and commodity traders via phishing messages.
TA412 cible des ONG américaines, des sociétés minières et de trading via spearphishing utilisant de faux étudiants et des conférences académiques. UNK_LateNight emploie des leurres B2B/RFQ.
UNK_DoubleCheck targeted a Vietnamese manufacturer using a compromised Southeast Asian government email account and a fake vaccination appointment.
The .NET in-memory payload is designed to create a scheduled task to launch the DLL sideloading sequence for persistence.
BlueMoon utilise curl pour télécharger puis exécuter un payload depuis le répertoire %TEMP%.
« chrome.exe → cmd.exe → curl.exe → msgbox.exe ».
UTA0565 chained Chrome CVE-2026-85046 and CVE-2026-87491 with the Windows ALPC flaw CVE-2026-85880 to achieve remote code execution; final shellcode downloaded "chrome_cleanup.exe."
Victims who followed the link reached actor-controlled infrastructure hosting BlueMoon.
The .NET in-memory payload is designed to create a scheduled task to launch the DLL sideloading sequence for persistence.
Successful exploitation delivered a loader that installed a malicious Chromium extension tracked by Proofpoint as GemStone.
The .NET in-memory payload is designed to create a scheduled task to launch the DLL sideloading sequence for persistence.
Post-exploitation, BlueMoon charge réflexivement une DLL.
The Chrome-Microsoft Windows exploit chain included CVE-2026-85880, affecting Windows Advanced Local Procedure Call, "to break out of the browser's sandbox."
Multiple variants of the exploit kit have been detected with subtle changes that removed comments or obfuscated its components.
Post-exploitation, BlueMoon charge réflexivement une DLL.
Attackers then exploit CVE-2026-87491 to bypass the V8 sandbox.
Following successful browser exploitation, BlueMoon reflectively loads a DLL to fingerprint the Windows host and determine whether it is compatible with the LPE stage.
BlueMoon reflectively loads a DLL to fingerprint the Windows host and determine whether it is compatible with the LPE stage.
BlueMoon utilise curl pour télécharger et exécuter un payload depuis le répertoire %TEMP%.
99 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
28 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.