BlueMoon exploit kit spreads to at least four cyber-espionage groups, researchers say

Security firms Proofpoint and Volexity have documented the kit's use by multiple threat actors, including groups tracked as TA412 (also known as Violet Typhoon/APT31) and UTA0560. The attackers exploit a “patch-gap” window between when Chromium fixes are committed upstream and when they appear in stable Chrome releases, reverse-engineering public code changes to create exploits.

BlueMoon chains three vulnerabilities: CVE-2026-85046, a type-confusion flaw in Chrome's V8 engine; a V8 sandbox escape (tracked as CVE-2026-87491 by BleepingComputer, though Google does not issue CVEs for sandbox escapes); and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC that allows local privilege escalation. Microsoft patched the Windows bug on September 9, and Google patched the Chrome bug on September 3.

Proofpoint's Mark Kelly noted that fewer than 20 organizations were observed targeted globally, but the true number is likely higher. The researchers believe AI agents may have lowered the barrier to entry for such exploit development, particularly for open-source codebases like Chromium. BlueMoon runs inside a Web Worker, retries exploits up to five times, and uses curl to drop a malware loader.

Both vendors have issued patches: Microsoft confirmed customers who applied the September 2026 Patch Tuesday update are protected, and Google warned that CVE-2026-85046 was being exploited in the wild before its fix.

Why This Matters

The BlueMoon kit demonstrates a rapidly shared, modular exploit capability that moves from developers to multiple threat actors in days, increasing the attack surface for organizations.
The “patch-gap” window in Chromium-based browsers creates a predictable vulnerability window that attackers can exploit, putting users at risk until downstream updates are applied.
AI-assisted reverse engineering may make high-quality exploit chains more accessible, potentially shifting the threat landscape for years to come.

Background

Exploit kits that chain multiple zero-day vulnerabilities are rare and historically expensive to develop. BlueMoon’s rapid spread across at least four groups suggests a lowering of development costs. The kit exploits the delay between upstream Chromium commits and stable releases, a supply chain weakness that has been exploited before but rarely with such coordinated adoption. The Windows privilege escalation bug (CVE-2026-85880) appears to have been repurposed from an earlier 2025 exploit, indicating the kit’s developers reused existing capabilities.

Key Perspectives

Proofpoint Researchers: The kit was developed and deployed rapidly, shared across multiple threat actors within days. They note AI may have enabled faster reverse engineering of patch-gap vulnerabilities. Volexity (UTA0560 tracking): Confirm similar activity targeting NGOs, with BlueMoon used in spearphishing campaigns starting September 1. Microsoft and Google: Both have issued patches. Microsoft emphasized that customers who applied the September 2026 updates are protected; Google acknowledged active exploitation of the Chrome bug before its fix.

What to Watch

Whether additional threat actors, including those not linked to China, adopt BlueMoon or similar kits.
How quickly organizations apply the September patches, especially for Chromium-based browsers where the patch-gap window may persist.
Further research on the role of AI in automating exploit development for open-source codebases, which could signal a new normal in cyber-espionage.

ZOTPAPER