Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

What’s new: Multiple espionage groups have rapidly adopted a new exploit kit named BlueMoon, which targets vulnerabilities in Microsoft Windows and Google Chrome. The first known use was by the China-aligned group APT31 on August 28, 2026. The exploit kit leverages three vulnerabilities: CVE-2026-85046 (a type confusion in V8 in Google Chrome), a V8 sandbox escape without a CVE identifier, and CVE-2026-85880 (a heap-based buffer overflow in Windows ALPC). Both CVE-2026-85046 and CVE-2026-85880 were patched by Google and Microsoft, respectively, in September 2026.

Who’s affected

Organizations in sectors such as non-governmental organizations, mining, aerospace, and finance have been targeted. Specific groups include APT31 and other China-aligned threat actors, which have used spear-phishing tactics to deploy BlueMoon against various entities in the U.S., Indonesia, and Singapore.

What to do

• Ensure that all systems are updated with the latest patches for Google Chrome and Microsoft Windows to mitigate the vulnerabilities exploited by BlueMoon.
• Check for signs of compromise, including unusual processes (e.g., chrome.exe starting cmd.exe), suspicious files in the %TEMP% folder, and specific scheduled tasks or registry keys mentioned in the report.
• Implement detection rules for the exploit kit’s JavaScript loader and command-and-control traffic as provided by Proofpoint.

Sources

• The Hacker News