Loading story…
Proofpoint reported that the BlueMoon exploit kit chains three vulnerabilities to compromise Windows systems through Google Chrome: CVE-2026-85046, a V8 arbitrary-code-execution/type-confusion flaw; CVE-2026-87491, a V8 sandbox escape; and CVE-2026-85880, a Windows ALPC local privilege-escalation vulnerability. First observed on August 28 in China-linked TA412 operations targeting U.S. NGOs, mining companies, and commodities-trading firms, the kit was adopted by multiple espionage groups within days, exploiting the gap between Chromium source-code fixes and stable-browser patch deployment.
Chinese actors identified as UTA0560 and JungleBamboo (APT31) used the Chrome-to-Windows chain in targeted spear-phishing against NGOs. UTA0560 deployed the GRIMWEDGE JScript backdoor, while JungleBamboo used SUPERSTOMP to install the LONGTALE credential-stealing Chrome extension. Organizations should prioritize Chrome and Windows security updates, investigate targeted phishing activity involving Chrome exploitation, and hunt for the named payloads and unauthorized browser extensions, particularly in NGO, mining, and commodities-trading environments.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
The Chromium-source fix for CVE-2026-85046 reached a stable Chromium version, ending the identified source-to-stable patch gap for that flaw.
China-linked TA412 (JungleBamboo/APT31) was first observed using the BlueMoon exploit chain against U.S. NGOs, mining companies, and commodities-trading firms. The chain combined two Chrome V8 flaws with a Windows ALPC privilege-escalation vulnerability.
A patch for the Chrome V8 type-confusion vulnerability CVE-2026-85046 appeared in Chromium source code, beginning a gap before it reached stable browser releases.
UTA0560 and JungleBamboo reportedly exploited the Chrome and Windows vulnerability chain in targeted spear-phishing against NGOs. UTA0560 deployed the GRIMWEDGE JScript backdoor, while JungleBamboo used SUPERSTOMP to install the LONGTALE credential-stealing Chrome extension.
Within days of the first observed use, UNK_LateNight targeted U.S. aerospace companies and deployed ShadowPad, UNK_DoubleCheck targeted a Vietnamese manufacturer, and China-associated UNK_QuietRacket targeted government, financial, and consulting organizations in Indonesia and Singapore.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 24 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcexakep.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple espionage-focused threat clusters have adopted the **BlueMoon** exploit kit, chaining Chromium V8 vulnerabilities, a V8 sandbox escape, and the Windows kernel privilege-escalation flaw `CVE-2026-85880` to gain code execution and elevated privileges. Older Windows 10 and Windows Server 2019/2022 builds are reported to be particularly exposed. The activity begins with phishing and has targeted U.S. NGOs, mining and commodity-trading firms, as well as government, defense, aerospace, manufacturing, financial, and commercial organizations across the United States and Southeast Asia. TA412, also tracked as Violet Typhoon and APT31, was the first identified user and used phishing to install the **GemStone** malicious browser extension. Additional clusters—UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket—have reportedly used the kit to deliver browser-surveillance payloads, ShadowPad, and other loaders. Proofpoint assessed that rapid adoption by several actors, exposed development artifacts, and exploitation during patch gaps suggest a shared exploit-procurement pipeline; AI-assisted development may also have lowered the barrier to weaponizing browser exploits.
Sep 15, 2026
Google has released an emergency security update to address CVE-2025-13223, a critical zero-day vulnerability in the V8 JavaScript engine used by Chrome and Chromium-based browsers. This type confusion flaw, discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG), allows attackers to achieve heap corruption and potentially execute arbitrary code simply by luring users to maliciously crafted websites. The vulnerability has been actively exploited in the wild, with Google confirming that threat actors are weaponizing it to bypass browser sandbox protections, steal credentials, escalate privileges, and deploy malware. The fix is included in Chrome version 142.0.7444.175/.176 for Windows, Mac, and Linux, and users are strongly urged to update and restart their browsers immediately to mitigate risk. Other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are also rolling out patches. The involvement of Google TAG suggests possible links to advanced persistent threats, highlighting the urgency for both individuals and enterprises to apply updates and monitor for suspicious activity.
Jun 29, 2026
Google released a **Stable Channel Update for Desktop** to fix `CVE-2025-2783`, a critical Chrome zero-day affecting Windows that allows a **sandbox escape** through a logical error at the browser and operating system interface. The flaw is in Chrome's **Mojo** component, carries a `CVSS 9.8` rating, and affects versions earlier than `134.0.6998.177`. Security researchers at Kaspersky, **Boris Larin** and **Igor Kuznetsov**, discovered the vulnerability, and CSIRT.SK reported that it was being **actively exploited** in attacks targeting Russian companies. Users were urged to update Chrome immediately to versions `134.0.6998.177` or `134.0.6998.178`, and organizations using other **Chromium-based browsers** were advised to apply corresponding vendor patches as they become available.
Jul 24, 2026