BlueMoon: four separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain within one week
Four espionage clusters ran the identical click-to-SYSTEM exploit kit within days of each other, Proofpoint calls it the same code, not parallel development
Defender actions
- After confirming Chrome ≥152.0.7977.82 and the September Windows cumulative update are deployed fleet-wide, separately audit installed Chromium extensions requesting broad host/tab/storage permissions and any browser-associated scheduled task created in the days before patching; neither the malicious GemStone extension nor the kit's scheduled-task persistence is removed by the OS/browser patch.
Analysis
Proofpoint documents BlueMoon, a newly named exploit kit chaining a Chrome V8 JIT type-confusion bug (CVE-2026-85046) with an uncredentialed V8 sandbox escape and a Windows kernel ALPC/WNF heap-overflow local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain (Proofpoint, 2026-09-08). The V8 bugs were a patch-gap zero-day: "the change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026" (Proofpoint, 2026-09-08), a nearly four-week window during which the public upstream diff let an exploit developer reverse-engineer and weaponize the bug before Chrome's stable channel shipped it; CVE-2026-85880 was separately patched by Microsoft as part of its September 2026 Patch Tuesday updates (The Hacker News, 2026-09-09); the referenced 2026-09-09 Windows entry covers Microsoft's own MSRC confirmation that it was exploited in the wild. After the browser-side chain achieves code execution and escapes the renderer sandbox, a reflectively loaded DLL fingerprints the host to decide whether to run the kernel LPE against a specific list of Windows builds, Proofpoint's own table names Windows 10 1809/2004/20H2/21H1/21H2/22H2, Windows 11 21H2's initial release build, and Server 2019/2022, a wider list than Microsoft's own advisory for this CVE, which describes the legacy line only and states it does not affect Windows 11 (Contradiction, unresolved here), then a process-injection stub runs an operator-supplied command inside the Chrome broker process, by default a plain curl download-and-execute, a deliberately crude step Proofpoint reads as evidence the developer traded stealth for speed. Four distinct espionage clusters adopted the identical kit within days of each other, each with its own delivery and payload: TA412/APT31 (from 2026-08-28) used student-internship and academic-conference spearphishing against US NGOs, mining and commodity-trading firms to install a malicious Chromium extension disguised as "Google Gemini" (GemStone), using an HMAC-forgery technique, named GhostChrome-X by outside researchers (The Hacker News, 2026-09-09), against Chrome's Secure Preferences integrity check so the extension survives the browser's own unauthorized-extension protection; GemStone keylogs, steals cookies/session storage, screenshots on keyword match and polls its C2 every 30 seconds to 60 minutes. UNK_LateNight (from 2026-09-02) targeted US aerospace/defense firms with B2B/RFQ lures to sideload the ShadowPad backdoor via a scheduled task. UNK_DoubleCheck (from 2026-09-02) phished a Vietnamese manufacturer from a compromised Southeast Asian government mailbox, obfuscating its loader and staging a second DLL from a Cloudflare R2 bucket. UNK_QuietRacket (from 2026-09-03) targeted government, consulting and financial-sector organizations in Indonesia and Singapore with conference-themed lures, resolving C2 entirely through DNS-over-HTTPS TXT-record lookups to a Cloudflare Worker. A Proofpoint researcher assessed the near-identical, simultaneous adoption as deliberate distribution rather than independent discovery: "there's no way that this is parallel development. The code is practically identical, even the variable naming, the commentary. It's the same kit. One hundred percent" (Mark Kelly, Proofpoint, via The Record, 2026-09-09). Patching Chrome and Windows closes the entry vector but removes nothing already installed, the GemStone extension, ShadowPad's DLL-sideload persistence, and the other clusters' scheduled tasks all survive a patch untouched.
Triage: a process tree rooted at the browser (browser → command shell → curl or a download utility → a newly dropped executable) is the chain's own crude final stage and a strong discriminator on its own; a scheduled task created immediately following a browser-initiated download narrows it further, since legitimate browser activity does not normally create scheduled tasks.
Cited evidence
The change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026.
While CVE-2026-85046 was patched by Google last week, CVE-2026-85880 was addressed by Microsoft as part of its September 2026 Patch Tuesday updates.
There’s no way that this is parallel development. The code is practically identical, even the variable naming, the commentary. It’s the same kit. One hundred percent.
Sources3
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.