Blab Tech
Proofpoint Detects Rapid Spread of Chrome-Based Exploit Kit "BlueMoon" Among State-Aligned Actors
On September 9, 2026, Proofpoint’s threat‑research team revealed that BlueMoon, a new exploit kit, is being used by multiple state‑aligned actors to target Chrome and Chromium‑based browsers on Windows. BlueMoon exploits a combination of two newly disclosed vulnerabilities in Google’s V8 JavaScript engine (CVE‑2026‑85046) and a Windows kernel local‑privilege‑escalation zero‑day (CVE‑2026‑85880) to elevate privileges on legacy Windows systems.
BlueMoon first surfaced on August 28, 2026, when the China‑aligned threat group TA412—also catalogued as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE—launched attacks against U.S. non‑governmental entities, mining firms, and commodity traders. Within a matter of days, other espionage‑driven groups, several of them suspected to have Chinese connections, adopted the kit. Proofpoint’s analysis shows that BlueMoon was disseminated rapidly among actors, pointing to either a shared source or a swift sharing mechanism.
The kit’s attack chain starts with a type‑confusion flaw in V8 that lets a crafted HTML page read and forge object pointers. Next, the attacker escapes the browser sandbox, overwriting WebAssembly function bodies with shellcode. Once the renderer process is subverted, a reflectively loaded DLL—named p2—executes a kernel‑level local‑privilege‑escalation on supported Windows builds (Windows 10 1809, 2004, 20H2, 21H1, 22H2, Server 2019, Server 2022, and Windows 11 21H2). This LPE lifts the renderer’s token, after which a second DLL, p1, injects shellcode that triggers a command‑line payload through curl. By default, the payload fetches an executable from a remote URL and runs it.
BlueMoon’s default setup is intentionally straightforward and easily detectable; the chain culminates in a curl command that downloads an executable called msgbox.exe from the attacker’s domain. During the TA412 campaign, msgbox.exe deployed a malicious Chromium extension dubbed GemStone, which pretended to be a Google Gemini companion. The extension harvested cookies, local storage, and browsing history, then relayed the data to a Cloudflare‑hosted command‑and‑control server.
BlueMoon has also been repurposed to deliver a variety of payloads. The China‑aligned group UNK_LateNight leveraged the kit to drop a DLL‑sideloading pair that installed the ShadowPad backdoor on U.S. aerospace companies. UNK_DoubleCheck—whose country of origin remains unknown—used the kit to fetch a Rust binary that conducted network sniffing and data exfiltration. Meanwhile, UNK_QuietRacket targeted Indonesian and Singaporean entities, tweaking the final injector to download a .NET assembly that set up a scheduled task for persistence.
Proofpoint observed that BlueMoon’s JavaScript code is littered with detailed logging, verbose comments, and links to a markdown handover document. Such characteristics hint at a development process that could involve large‑language‑model assistance, though no definitive evidence confirms AI involvement. The kit also contains nods to Google’s V8 CTF challenge, implying that the creators might have used the challenge as a framework or a smokescreen.
The V8 flaws that BlueMoon targets were fixed in the upstream Chromium source on August 7, 2026, yet the patch did not reach stable Chrome releases until September 3, 2026. This “patch‑gap” gave the kit a window to be weaponized before most users benefited from the fix. Proofpoint’s researchers worked with Google Threat Intelligence Group, Microsoft Threat Intelligence Center, and Volexity to pinpoint and attribute the activity.
Defenders can spot BlueMoon by looking for a process chain—chrome.exe leading to cmd.exe, then curl.exe, and finally msgbox.exe—alongside scheduled tasks titled EdgeCore_AutoUpdate, registry writes to CLSID entries, and a sessionStorage key called v8ctf_exp_attempt. Proofpoint has released a YARA rule, MAL_BlueMoon_ExploitKit, to help security teams detect the kit.
Proofpoint believes BlueMoon will spread further, as its design reduces the entry barrier for both espionage and financially motivated actors. The swift adoption of a single exploit chain highlights the mounting threat that patch‑gap zero‑days in widely used open‑source projects present.
The threat remains active. BlueMoon attacks keep surfacing in fresh phishing campaigns, and its components are still circulating in the wild. Security teams should update Chrome and Chromium‑based browsers to version 152.0.7977.82 or newer, apply the latest Windows cumulative updates, and keep an eye on the process and registry indicators outlined above.
BlueMoon first surfaced on August 28, 2026, when the China‑aligned threat group TA412—also catalogued as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE—launched attacks against U.S. non‑governmental entities, mining firms, and commodity traders. Within a matter of days, other espionage‑driven groups, several of them suspected to have Chinese connections, adopted the kit. Proofpoint’s analysis shows that BlueMoon was disseminated rapidly among actors, pointing to either a shared source or a swift sharing mechanism.
The kit’s attack chain starts with a type‑confusion flaw in V8 that lets a crafted HTML page read and forge object pointers. Next, the attacker escapes the browser sandbox, overwriting WebAssembly function bodies with shellcode. Once the renderer process is subverted, a reflectively loaded DLL—named p2—executes a kernel‑level local‑privilege‑escalation on supported Windows builds (Windows 10 1809, 2004, 20H2, 21H1, 22H2, Server 2019, Server 2022, and Windows 11 21H2). This LPE lifts the renderer’s token, after which a second DLL, p1, injects shellcode that triggers a command‑line payload through curl. By default, the payload fetches an executable from a remote URL and runs it.
BlueMoon’s default setup is intentionally straightforward and easily detectable; the chain culminates in a curl command that downloads an executable called msgbox.exe from the attacker’s domain. During the TA412 campaign, msgbox.exe deployed a malicious Chromium extension dubbed GemStone, which pretended to be a Google Gemini companion. The extension harvested cookies, local storage, and browsing history, then relayed the data to a Cloudflare‑hosted command‑and‑control server.
BlueMoon has also been repurposed to deliver a variety of payloads. The China‑aligned group UNK_LateNight leveraged the kit to drop a DLL‑sideloading pair that installed the ShadowPad backdoor on U.S. aerospace companies. UNK_DoubleCheck—whose country of origin remains unknown—used the kit to fetch a Rust binary that conducted network sniffing and data exfiltration. Meanwhile, UNK_QuietRacket targeted Indonesian and Singaporean entities, tweaking the final injector to download a .NET assembly that set up a scheduled task for persistence.
Proofpoint observed that BlueMoon’s JavaScript code is littered with detailed logging, verbose comments, and links to a markdown handover document. Such characteristics hint at a development process that could involve large‑language‑model assistance, though no definitive evidence confirms AI involvement. The kit also contains nods to Google’s V8 CTF challenge, implying that the creators might have used the challenge as a framework or a smokescreen.
The V8 flaws that BlueMoon targets were fixed in the upstream Chromium source on August 7, 2026, yet the patch did not reach stable Chrome releases until September 3, 2026. This “patch‑gap” gave the kit a window to be weaponized before most users benefited from the fix. Proofpoint’s researchers worked with Google Threat Intelligence Group, Microsoft Threat Intelligence Center, and Volexity to pinpoint and attribute the activity.
Defenders can spot BlueMoon by looking for a process chain—chrome.exe leading to cmd.exe, then curl.exe, and finally msgbox.exe—alongside scheduled tasks titled EdgeCore_AutoUpdate, registry writes to CLSID entries, and a sessionStorage key called v8ctf_exp_attempt. Proofpoint has released a YARA rule, MAL_BlueMoon_ExploitKit, to help security teams detect the kit.
Proofpoint believes BlueMoon will spread further, as its design reduces the entry barrier for both espionage and financially motivated actors. The swift adoption of a single exploit chain highlights the mounting threat that patch‑gap zero‑days in widely used open‑source projects present.
The threat remains active. BlueMoon attacks keep surfacing in fresh phishing campaigns, and its components are still circulating in the wild. Security teams should update Chrome and Chromium‑based browsers to version 152.0.7977.82 or newer, apply the latest Windows cumulative updates, and keep an eye on the process and registry indicators outlined above.
