--- schema: 1 kind: threat title: "BlueMoon: four separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain within one week" headline: "Four espionage clusters ran the identical click-to-SYSTEM exploit kit within days of each other — Proofpoint calls it the same code, not parallel development" summary: > Proofpoint documents BlueMoon, an exploit kit chaining a Chrome V8 patch-gap zero-day (CVE-2026-85046) with a Windows kernel ALPC/WNF local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain, independently adopted within days of each other by TA412/APT31 and three new China-nexus clusters targeting US, Vietnamese and Southeast Asian government, aerospace and manufacturing victims. Both CVEs are patched, but the kit's persistence mechanisms — a malicious browser extension, DLL sideloading, scheduled tasks — survive an OS/browser patch untouched. discovered_at: "2026-09-10T04:50:00Z" updated_at: null event_date: "2026-09-08" run_id: 2026-09-10T0410Z-intel priority: high immediate_action: null tags: [nation-state, espionage, zero-day, actively-exploited, china-nexus] regions: [global, us, apac] sectors: [public-sector, defense, manufacturing] entities: ["actor:apt31", "actor:unk-latenight", "actor:unk-doublecheck", "actor:unk-quietracket", "tool:bluemoon-exploit-kit", "tool:gemstone-browser-extension", "tool:ghostchrome-x", "malware:shadowpad"] techniques: [T1566.002, T1189, T1203, T1068, T1055, T1105, T1176, T1539, T1056.001, T1071.001, T1071.004, T1574.001, T1053.005, T1027] affected_products: ["Google Chrome", "Microsoft Edge", "Microsoft Windows"] cves: - id: CVE-2026-85046 cvss: "8.8" epss: null type: rce vector: user-interaction auth: pre-auth status: [exploited, patch-available] affected: "< Chrome 152.0.7977.82" fixed: "Chrome 152.0.7977.82/.83" - id: CVE-2026-85880 cvss: "7.8" epss: null type: priv-esc vector: zero-click auth: post-auth status: [exploited, cisa-kev, patch-available] affected: "Per Proofpoint's own exploit build-support table: Windows 10 1809 (build 17763) and 2004/20H2/21H1/21H2/22H2 (builds 19041-19045), Windows 11 21H2 initial release (build 22000), Windows Server 2019 and Server 2022 — a broader list than Microsoft's own advisory for this CVE, which states the legacy line only and excludes Windows 11 (see body note)" fixed: "September 2026 Windows cumulative updates" sources: - url: "https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit" publisher: "Proofpoint Threat Research" date: "2026-09-08" role: primary - url: "https://therecord.media/china-hackers-chrome-browser-zero-day-multiple-groups" publisher: "The Record (Recorded Future News)" date: "2026-09-09" role: corroborating - url: "https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html" publisher: "The Hacker News" date: "2026-09-09" role: corroborating closed_sources: [] evidence: - quote: "The change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026." publisher: "Proofpoint Threat Research" - quote: "While CVE-2026-85046 was patched by Google last week, CVE-2026-85880 was addressed by Microsoft as part of its September 2026 Patch Tuesday updates." publisher: "The Hacker News" - quote: "There’s no way that this is parallel development. The code is practically identical — even the variable naming, the commentary. It’s the same kit. One hundred percent." publisher: "The Record (Recorded Future News)" verification: multi-source sourcing_note: "The multi-actor same-kit conclusion is Proofpoint's own technical assessment; The Record and The Hacker News report on and corroborate publication of that finding rather than independently re-deriving it. Proofpoint's own build-support table for the LPE exploit lists Windows 11 21H2 (build 22000) as a targeted build, which is wider than Microsoft's own MSRC advisory for CVE-2026-85880 (cited by the referenced 2026-09-09 entry), which describes the legacy line only and explicitly excludes Windows 11 — this entry records what Proofpoint's own exploit targets, and flags rather than resolves the discrepancy with Microsoft's stated scope." confidence: high references: - "2026-09-04/cve-2026-85046-chrome-v8-type-confusion-exploited" - "2026-09-09/windows-september-2026-two-exploited-lpe-zero-days-kev" deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 2 watchlist_hit: false actions: - "After confirming Chrome ≥152.0.7977.82 and the September Windows cumulative update are deployed fleet-wide, separately audit installed Chromium extensions requesting broad host/tab/storage permissions and any browser-associated scheduled task created in the days before patching — neither the malicious GemStone extension nor the kit's scheduled-task persistence is removed by the OS/browser patch." updates: [] migrated_from: null --- Proofpoint documents BlueMoon, a newly named exploit kit chaining a Chrome V8 JIT type-confusion bug (CVE-2026-85046) with an uncredentialed V8 sandbox escape and a Windows kernel ALPC/WNF heap-overflow local-privilege-escalation flaw (CVE-2026-85880) into a single click-to-SYSTEM chain ([Proofpoint, 2026-09-08](https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit)). The V8 bugs were a patch-gap zero-day: "the change containing the fix for CVE-2026-85046 was committed on 7 August 2026 but was not rolled into the general stable Chromium build until 3 September 2026" ([Proofpoint, 2026-09-08](https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit)), a nearly four-week window during which the public upstream diff let an exploit developer reverse-engineer and weaponize the bug before Chrome's stable channel shipped it; CVE-2026-85880 was separately patched by Microsoft as part of its September 2026 Patch Tuesday updates ([The Hacker News, 2026-09-09](https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html)) — the referenced 2026-09-09 Windows entry covers Microsoft's own MSRC confirmation that it was exploited in the wild. After the browser-side chain achieves code execution and escapes the renderer sandbox, a reflectively loaded DLL fingerprints the host to decide whether to run the kernel LPE against a specific list of Windows builds — Proofpoint's own table names Windows 10 1809/2004/20H2/21H1/21H2/22H2, Windows 11 21H2's initial release build, and Server 2019/2022, a wider list than Microsoft's own advisory for this CVE, which describes the legacy line only and states it does not affect Windows 11 (**Contradiction**, unresolved here) — then a process-injection stub runs an operator-supplied command inside the Chrome broker process — by default a plain curl download-and-execute, a deliberately crude step Proofpoint reads as evidence the developer traded stealth for speed. Four distinct espionage clusters adopted the identical kit within days of each other, each with its own delivery and payload: TA412/APT31 (from 2026-08-28) used student-internship and academic-conference spearphishing against US NGOs, mining and commodity-trading firms to install a malicious Chromium extension disguised as "Google Gemini" (GemStone), using an HMAC-forgery technique — named GhostChrome-X by outside researchers ([The Hacker News, 2026-09-09](https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html)) — against Chrome's Secure Preferences integrity check so the extension survives the browser's own unauthorized-extension protection; GemStone keylogs, steals cookies/session storage, screenshots on keyword match and polls its C2 every 30 seconds to 60 minutes. UNK_LateNight (from 2026-09-02) targeted US aerospace/defense firms with B2B/RFQ lures to sideload the ShadowPad backdoor via a scheduled task. UNK_DoubleCheck (from 2026-09-02) phished a Vietnamese manufacturer from a compromised Southeast Asian government mailbox, obfuscating its loader and staging a second DLL from a Cloudflare R2 bucket. UNK_QuietRacket (from 2026-09-03) targeted government, consulting and financial-sector organizations in Indonesia and Singapore with conference-themed lures, resolving C2 entirely through DNS-over-HTTPS TXT-record lookups to a Cloudflare Worker. A Proofpoint researcher assessed the near-identical, simultaneous adoption as deliberate distribution rather than independent discovery: "there's no way that this is parallel development. The code is practically identical — even the variable naming, the commentary. It's the same kit. One hundred percent" ([Mark Kelly, Proofpoint, via The Record, 2026-09-09](https://therecord.media/china-hackers-chrome-browser-zero-day-multiple-groups)). Patching Chrome and Windows closes the entry vector but removes nothing already installed — the GemStone extension, ShadowPad's DLL-sideload persistence, and the other clusters' scheduled tasks all survive a patch untouched. **Defender takeaway:** treat this as two separate hunts, not one patch cycle — after confirming Chrome ≥152.0.7977.82 and the September Windows cumulative update are deployed, separately audit installed Chromium extensions requesting broad host/tab/storage permissions and any browser-associated scheduled task created in the days before patching, since neither is removed by the update. **Triage:** a process tree rooted at the browser (browser → command shell → curl or a download utility → a newly dropped executable) is the chain's own crude final stage and a strong discriminator on its own; a scheduled task created immediately following a browser-initiated download narrows it further, since legitimate browser activity does not normally create scheduled tasks.