BlueMoon Exploit Kit Chains Chromium and Windows Zero-Days in Espionage Campaigns

Multiple espionage-focused threat clusters have adopted the BlueMoon exploit kit, chaining Chromium V8 vulnerabilities, a V8 sandbox escape, and the Windows kernel privilege-escalation flaw CVE-2026-85880 to gain code execution and elevated privileges. Older Windows 10 and Windows Server 2019/2022 builds are reported to be particularly exposed. The activity begins with phishing and has targeted U.S. NGOs, mining and commodity-trading firms, as well as government, defense, aerospace, manufacturing, financial, and commercial organizations across the United States and Southeast Asia.

TA412, also tracked as Violet Typhoon and APT31, was the first identified user and used phishing to install the GemStone malicious browser extension. Additional clusters—UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket—have reportedly used the kit to deliver browser-surveillance payloads, ShadowPad, and other loaders. Proofpoint assessed that rapid adoption by several actors, exposed development artifacts, and exploitation during patch gaps suggest a shared exploit-procurement pipeline; AI-assisted development may also have lowered the barrier to weaponizing browser exploits.