Loading story…
Multiple espionage-focused threat clusters have adopted the BlueMoon exploit kit, chaining Chromium V8 vulnerabilities, a V8 sandbox escape, and the Windows kernel privilege-escalation flaw CVE-2026-85880 to gain code execution and elevated privileges. Older Windows 10 and Windows Server 2019/2022 builds are reported to be particularly exposed. The activity begins with phishing and has targeted U.S. NGOs, mining and commodity-trading firms, as well as government, defense, aerospace, manufacturing, financial, and commercial organizations across the United States and Southeast Asia.
TA412, also tracked as Violet Typhoon and APT31, was the first identified user and used phishing to install the GemStone malicious browser extension. Additional clusters—UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket—have reportedly used the kit to deliver browser-surveillance payloads, ShadowPad, and other loaders. Proofpoint assessed that rapid adoption by several actors, exposed development artifacts, and exploitation during patch gaps suggest a shared exploit-procurement pipeline; AI-assisted development may also have lowered the barrier to weaponizing browser exploits.
See which actors are running it and whether you're in range.
14 events from the most recent confirmed update back to the earliest known activity.
Proofpoint observed BlueMoon exploit-chain use as recently as September 8, 2026, after activity peaked on September 2-3. The firm directly observed fewer than 20 targeted organizations globally and assessed that the actual number was likely higher.
CISA added the actively exploited Chrome V8 type-confusion vulnerability CVE-2026-85046 to its Known Exploited Vulnerabilities catalog and set a September 18 remediation deadline for U.S. federal civilian agencies.
On September 1, 2026, UTA0560 spear-phished multiple NGO customers using a Chrome-to-Windows exploit chain and deployed the GRIMWEDGE JScript backdoor. JungleBamboo/TA412 used byte-identical core exploit shellcode against a different target set on September 1-2, deploying SUPERSTOMP and the LONGTALE credential-stealing Chrome extension.
Proofpoint identified TA412, also known as Violet Typhoon or APT31, as the first confirmed BlueMoon user. The group targeted U.S. NGOs, mining firms, and commodity traders with phishing impersonating university interns and academic outreach, deploying the GemStone browser-surveillance extension.
Chromium upstream fixed the V8 vulnerabilities used by BlueMoon through a commit on August 7, 2026. The fixes were reportedly not incorporated into stable Chrome releases until before September 3, creating a patch-gap window exploited by the kit.
Proofpoint reported that at least four espionage-oriented threat clusters began using the BlueMoon browser-and-Windows exploit kit in late August 2026. The company assessed that most observed users had a suspected China nexus.
Intellexa used its custom Chrome exploitation framework with the V8 type-confusion vulnerability CVE-2025-6554 in activity observed in Saudi Arabia. Google mitigated the issue through a configuration change before later fixing it in Chrome 138.0.7204.96.
Researchers published network and email indicators for BlueMoon activity, including IP address 79.133.56.90, domains such as secboxes.com and msbenefit.com, and Cloudflare Workers and R2-hosted infrastructure. The report also provided suspicious payload paths, including ChromeUpdate.exe and krita.dll, along with associated SHA-256 hashes.
CISA added all three vulnerabilities exploited by the BlueMoon Chrome-to-Windows exploit chain to its Known Exploited Vulnerabilities catalog, expanding beyond the previously recorded listing of Chrome V8 flaw CVE-2026-85046.
All three vulnerabilities exploited by the BlueMoon kit—two Chromium flaws and a Windows kernel flaw—received patches within the 24 hours preceding the report. Proofpoint assessed that attackers exploited the lag between upstream Chromium fixes and their adoption by downstream browsers such as Chrome and Edge.
UNK_QuietRacket targeted government and financial organizations in Indonesia and Singapore using conference-themed phishing. The cluster used DNS-over-HTTPS command-and-control channels.
UNK_DoubleCheck compromised a Southeast Asian government email account to target a Vietnamese manufacturer. The operation used a Rust-based loader.
The cluster tracked as UNK_LateNight used defense-procurement-themed phishing against U.S. aerospace companies. Its campaign delivered the ShadowPad backdoor through a DLL-sideloading chain.
Proofpoint named and described BlueMoon as an exploit kit chaining Chromium V8 type-confusion flaw CVE-2026-85046, a V8 sandbox escape, and Windows kernel privilege-escalation flaw CVE-2026-85880. The Windows component reportedly affects older Windows 10 and Windows Server 2019/2022 builds and uses ALPC and Windows Notification Facility mechanisms to obtain kernel read/write access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 128 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
19 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcesecurityweek.com
Open sourcecysecurity.news
Open sourcecyberveille.ch
Open sourcethehackernews.com
Open sourcecloud.google.com
Open sourcedeveloper.chrome.com
Open sourcesynacktiv.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher using the aliases **Chaotic Eclipse** and **Nightmare-Eclipse** publicly released working GitHub exploit code for **BlueHammer**, an unpatched Windows local privilege escalation flaw tied to Microsoft Defender’s signature update process. Independent testing by Will Dormann and others found the exploit worked, though reliability varied by platform and configuration. The attack abuses a **TOCTOU** race condition and path confusion in Defender’s update workflow, chaining components such as **VSS**, the **Cloud Files API**, and opportunistic locks to expose protected registry hives including `SAM`, `SYSTEM`, and `SECURITY`, extract NTLM password hashes, and potentially elevate a low-privileged user to **NT AUTHORITY\SYSTEM**. Microsoft initially responded with a Defender detection signature for the published proof of concept, but researchers warned that signature-based blocking did not address the underlying logic flaw. The issue was later tracked as **`CVE-2026-33825`** and patched by Microsoft on April 14, after which **CISA** ordered U.S. federal civilian agencies to remediate it within two weeks and added it to the **Known Exploited Vulnerabilities** catalog. Huntress reported the vulnerability was being used in zero-day intrusions involving hands-on-keyboard activity, and follow-on tooling such as **BlueSAM** showed how quickly the public disclosure was adapted for offensive use.
Jul 8, 2026
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Multiple exploit kits remained active despite the broader decline of the exploit-kit ecosystem, using **malvertising**, compromised sites, and traffic distribution systems to drive victims to landing pages that exploited legacy **Internet Explorer** and **Adobe Flash Player** vulnerabilities. Reports identified **RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude, Angler,** and **GreenFlash Sundown** abusing flaws including `CVE-2021-26411`, `CVE-2020-1380`, `CVE-2018-8174`, `CVE-2018-15982`, `CVE-2018-4878`, `CVE-2016-0189`, and `CVE-2015-0311`. Researchers said continued Internet Explorer use, unsupported Flash installations, and region-specific targeting kept drive-by download attacks viable, particularly across Japan, South Korea, Taiwan, Hong Kong, Malaysia, and other parts of Asia. The campaigns delivered a wide range of malware families, showing that exploit kits were still an effective access vector for both cybercrime and broader malware operations. **Spelevo** was tied to the Japanese **PseudoGate** campaign distributing **Ursnif**, **SmokeLoader**, **Ramnit**, **Kronos**, and **Zloader**; **RIG** was seen pushing **Pitou.B** and ransomware such as **CryptoLuck** and **Revenge**; **Magnitude** delivered **Magniber** ransomware; **Underminer** deployed a **bootkit** and **coinminer**; **GreenFlash Sundown** delivered **Hermes** ransomware; **Angler** installed the **Bedep** trojan; and **PurpleFox** was linked to **DirtyMoe** cryptojacking and DDoS malware. The reporting underscored that unpatched or unsupported browsers and plugins continued to expose organizations to silent compromise, ransomware, banking trojans, spam bots, and cryptomining infections.
Aug 15, 2026