> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days
- URL: https://f4n6.co.uk/security-feed/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/
- Published: 2026-09-12T18:40:33.000Z
- Updated: 2026-09-12T18:40:33.000Z
- Author: Jeff Davies
- Tags: #security-feed, BlueMoon

## 1\. Executive summary

Proofpoint has documented a previously undocumented exploit kit, "BlueMoon," that chains two Google Chrome V8 zero-days (CVE-2026-85046, CVE-2026-87491) with a Windows Advanced Local Procedure Call (ALPC) privilege-escalation zero-day (CVE-2026-85880) to achieve code execution and post-exploitation payload delivery on Windows endpoints. All three vulnerabilities are in the CISA Known Exploited Vulnerabilities (KEV) catalog. First observed in use on 28 August 2026 by the China-linked actor Violet Typhoon (APT31/TA412), the kit was adopted within days by at least three additional espionage-motivated clusters — most with a suspected China nexus — against NGOs, mining and commodity-trading firms, aerospace, manufacturing, and government, consulting, and **financial entities in Indonesia and Singapore**. Attribution of the "BlueMoon" name carries no MITRE ATT&CK profile in our verified reference data and must be treated as unconfirmed; the underlying actor attributions (Violet Typhoon/APT31) rest on Proofpoint's reporting. The direct risk to EMEA financial services is opportunistic drive-by compromise of unpatched Chrome/Edge endpoints via phishing-delivered links; the Southeast Asia targeting of financial entities indicates the sector is already in scope.

## 2\. Regulatory framing

| Article                                                                     | Trigger (the fact in this item)                                                                                                                                                                                                                                | Practical impact                                                                                                                                                                                                                             |
| --------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 18: classification of ICT-related incidents and cyber threats     | BlueMoon is a multi-actor cyber threat exploiting KEV-listed vulnerabilities, with confirmed targeting of financial entities (Indonesia/Singapore) — a threat that must be classified under the entity's ICT incident and cyber-threat classification process. | Clients should classify BlueMoon-related exposure (unpatched Chrome/Edge/Windows estates) within their DORA Art. 18 taxonomy and feed it into incident-management and reporting decisions.                                                   |
| DORA Art. 24: digital operational resilience testing — general requirements | The campaign weaponised "patch-gap" zero-days — flaws fixed upstream in Chromium on 7 August but unpatched in stable browser releases for weeks — meaning standard patch cadence did not cover the exposure window.                                            | Resilience testing should include verification that browser patch SLAs (particularly for KEV-listed, actively exploited flaws) are actually met, and that Chromium-based third-party browsers (not just Google Chrome) are in patch scope.   |
| NIS2 Art. 21(2)(d): supply chain security measures                          | The exploit chain relies on a Windows ALPC privilege-escalation (CVE-2026-85880) and affects all Chromium-based browsers including Microsoft Edge — supply-chain-delivered components outside direct client control whose patching status determines exposure. | Clients in NIS2 scope should verify that third-party and managed endpoints (including those running Edge or other Chromium forks) receive the relevant September 2026 Chrome and Windows patches, as part of supply-chain security measures. |

## 3\. Technical analysis & attack chain

### Confirmed attack chain (per Proofpoint, as reported by SecurityWeek and The Register)

1. **Initial access — phishing.** Victims receive a phishing email and click a malicious link, which directs them to an attacker-controlled web page hosting the BlueMoon exploit kit.
2. **V8 exploitation — remote code execution.** The page exploits two vulnerabilities in Chrome's V8 JavaScript and WebAssembly engine: - **CVE-2026-85046** — V8 type confusion allowing remote code execution. Affects all Chromium-based browsers, including Google Chrome and Microsoft Edge. The upstream Chromium fix was committed on **7 August 2026**; Google patched it in Chrome Stable on **3 September 2026** (fixed in Chrome 152.0.7977.82/.83 for Windows/macOS, 152.0.7977.82 for Linux), warning that an exploit existed in the wild. Microsoft fixed it in **Edge Stable 152.0.4191.62 on 2 September 2026**. It was the fifth Chrome zero-day patched in 2026\. - **CVE-2026-87491** — second V8 flaw, patched as a zero-day on **8 September 2026**. - Both were "patch-gap" zero-days at time of use: fixed upstream in Chromium source but unpatched in public stable releases for weeks.
3. **Sandbox escape.** A Chrome V8 sandbox escape (no CVE assigned — Google does not issue CVEs for sandbox escapes) breaks out of the browser's sandbox. This also affected all Chromium-based browsers.
4. **Host fingerprinting.** The kit fingerprints the host.
5. **Privilege escalation.** Exploits **CVE-2026-85880**, a privilege-escalation vulnerability in Windows Advanced Local Procedure Call (ALPC). Microsoft patched it in the September 2026 Patch Tuesday release and confirmed it was exploited as a zero-day prior to the update.
6. **Payload delivery.** A **CreateProcess stub is injected into the parent Chrome broker process**, which downloads an executable via a **curl command** and executes it.

### Key technical specifics

- **Affected software:** All Chromium-based browsers (Google Chrome, Microsoft Edge, and other forks) on Windows; Windows operating systems vulnerable to CVE-2026-85880.
- **Packaging:** Proofpoint identified several packaging variations of BlueMoon, all using the same underlying exploit chain and identical orchestration and loading mechanisms.
- **CISA KEV:** All three vulnerabilities have been added to the KEV catalog.
- **AI-development indicators:** Retrieved development artifacts suggest the kit's creators may have used AI to build it, though no single artifact conclusively confirms this. Proofpoint assesses that AI agents increasingly enable threat-actor exploit development, particularly for open-source codebases like Chromium where upstream patches create a patch-gap window for rapid reverse engineering.

### Attribution and targeting — confidence caveats

- Attribution of the first use to **Violet Typhoon (APT31/TA412/Judgement Panda/JungleBamboo/Tide Castle/Bronze Vinewood)**, and of subsequent use to UNK\_LateNight, UNK\_DoubleCheck, and UNK\_QuietRacket, is **single-sourced to Proofpoint** and should be verified before being used for enforcement or attribution-driven blocking decisions. The Register notes US authorities have previously linked TA412 to China's Ministry of State Security and charged seven alleged members.
- The "BlueMoon" actor name has **no MITRE ATT&CK profile** in our verified reference data — treat the attribution as unconfirmed.
- Proofpoint states it is currently unknown how multiple distinct threat actors obtained access to the kit, and that activity may not be exclusive to China-aligned groups.
- Scale: fewer than 20 organisations observed targeted globally, but Proofpoint assesses the true number is "almost certainly higher."

## 4\. Mitigation & containment

### P1 — within 24 hours

- **Patch Chrome to ≥ 152.0.7977.82/.83 (Windows/macOS) / 152.0.7977.82 (Linux)** — covers CVE-2026-85046\. Verify the 8 September update covering CVE-2026-87491 is also applied; force browser relaunch via enterprise policy where users defer updates.
- **Patch Microsoft Edge to ≥ 152.0.4191.62** — covers CVE-2026-85046 in Edge.
- **Apply the September 2026 Windows Patch Tuesday updates** — covers CVE-2026-85880 (ALPC privilege escalation). Microsoft confirms patched customers are protected.
- **Hunt for the delivery mechanism:** search EDR telemetry for **curl.exe spawned by Chrome broker processes** (or any browser process spawning curl), and for unexpected child processes of chrome.exe — the CreateProcess stub injection into the Chrome broker is the distinctive post-exploitation signal.
- **Block/monitor:** alert on browser processes initiating downloads followed by process execution of the downloaded executable.

### P2 — within 72 hours

- **Extend patch verification to all Chromium-based browsers** in the estate — the V8 flaws and sandbox escape affect every Chromium fork, not only Chrome and Edge. Inventory any Chromium forks (e.g., vendor-embedded browsers, third-party applications shipping Chromium) and confirm their patch status with vendors.
- **Review email security posture** against the phishing-link initial access vector; confirm URL rewriting and time-of-click sandboxing is enabled.
- **Hunt retrospectively** for activity since **28 August 2026** (first observed BlueMoon use) on endpoints running unpatched Chrome/Edge: browser crashes followed by curl.exe execution, ALPC-related anomalies, and unexplained executable downloads.

### P3 — within 7 days

- **Update vulnerability-management policy for KEV-listed flaws:** treat CISA KEV addition as a trigger for expedited (non-standard-cadence) patching, given the demonstrated patch-gap weaponisation window.
- **Review browser patch SLAs:** the upstream Chromium fix for CVE-2026-85046 existed from 7 August but stable releases were unpatched for weeks — assess whether your browser update ring structure leaves a comparable gap and compress it for actively exploited flaws.
- **Brief SOC and fraud/compliance teams** on the espionage (not financially motivated) nature of the observed activity to date, while noting Proofpoint's assessment that financially motivated adoption is likely.

## 5\. Indicators of compromise

No indicators of compromise available in the source material.

### Behavioural indicators

| Behaviour                                                                                    | Where to observe                                                                    | Confidence                                     |
| -------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------- |
| Phishing email containing a link to exploit-kit hosting page                                 | Email gateway logs, email security telemetry                                        | High (multi-source corroborated)               |
| Chrome broker process spawning curl.exe to download an executable, then executing it         | EDR process telemetry (parent-child: chrome.exe → curl.exe → downloaded executable) | High (per Proofpoint, single-sourced detail)   |
| CreateProcess stub injected into parent Chrome broker process                                | EDR injection detection, memory forensics                                           | High (per Proofpoint, single-sourced detail)   |
| Host fingerprinting following sandbox escape, prior to privilege escalation                  | EDR behavioural analytics post-browser-crash                                        | Medium (per Proofpoint, single-sourced detail) |
| Browser (V8) crash or abnormal termination immediately preceding suspicious process activity | Endpoint crash logs, EDR                                                            | Medium (inferred from exploit-chain structure) |

## 6\. Detection

```yara
rule EXPLOIT_KIT_BlueMoon_Chrome_Broker_Stub
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-12"
        reference = "https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/"
        description = "Detects BlueMoon exploit kit delivery stub based on CreateProcess injection into Chrome broker and curl-based payload download behaviour."
    strings:
        $create_process = "CreateProcess" ascii
        $curl_download = "curl" ascii
    condition:
        all of them
}

```

```yaml
title: BlueMoon exploit kit - Chrome broker process spawning curl to download and execute payload
id: AT-2026-09-12-859-01
status: experimental
description: Detects the BlueMoon exploit kit post-exploitation behaviour where a CreateProcess stub injected into the parent Chrome broker process downloads an executable via curl and executes it.
references:

    - https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/
    - https://www.theregister.com/research/2026/09/09/novel-blue-moon-kit-targeting-chrome-and-windows-reflects-new-reality-of-ai-driven-exploits/5295399
author: Adverse Trace
date: 2026/09/12
logsource:
    category: process_creation
    product: windows
detection:
    selection_browser_parent:
        ParentImage|endswith: '\chrome.exe'
    selection_curl:
        Image|endswith: '\curl.exe'
    condition: selection_browser_parent and selection_curl
falsepositives:

    - Legitimate browser extensions or applications that invoke curl from Chrome processes (rare)
level: high

```

## 7\. Sources

- SecurityWeek — *BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days* — https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/ — 2026-09-12
- The Register — *Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits* — https://www.theregister.com/research/2026/09/09/novel-blue-moon-kit-targeting-chrome-and-windows-reflects-new-reality-of-ai-driven-exploits/5295399 — 2026-09-09
- Malwarebytes Labs — *BlueMoon exploit kit turns Chrome and Windows flaws into attacks* — https://www.malwarebytes.com/blog/bugs/2026/09/bluemoon-exploit-kit-turns-chrome-and-windows-flaws-into-attacks — 2026-09
- The Hacker News — *Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week* — https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html — 2026-09
- BleepingComputer — *Google patches new Chrome zero-day flaw exploited in the wild* — https://www.bleepingcomputer.com/news/security/google-patches-fifth-chrome-zero-day-bug-exploited-in-attacks-this-year/ — 2026-09
- Help Net Security — *Google patches actively exploited Chrome zero-day (CVE-2026-85046)* — https://www.helpnetsecurity.com/2026/09/04/google-chrome-zero-day-cve-2026-85046/ — 2026-09-04
- SecurityWeek — *Google Patches 5th Chrome Zero-Day Exploited in 2026* — https://www.securityweek.com/google-patches-5th-chrome-zero-day-exploited-in-2026/ — 2026-09

## 8\. Adverse Trace position

BlueMoon is significant less for its individual components — three now-patched, KEV-listed vulnerabilities — than for what it demonstrates about attacker speed: a full RCE-plus-sandbox-escape-plus-privilege-escalation chain was developed, shared, and adopted by at least four distinct espionage clusters within roughly a week of first observed use, exploiting a patch-gap window between upstream Chromium fixes and downstream stable releases. All clients running unpatched Chromium-based browsers or Windows endpoints are exposed to opportunistic compromise via phishing-delivered links; financial entities in Southeast Asia have already been targeted directly, and Proofpoint assesses proliferation to financially motivated actors is likely. Attribution remains single-sourced to Proofpoint and the "BlueMoon" designation has no MITRE ATT&CK profile in our verified data — treat it as unconfirmed. The immediate action is unambiguous: apply the 3/8 September Chrome updates, the Edge 152.0.4191.62 update, and September 2026 Windows Patch Tuesday, and hunt for chrome.exe → curl.exe process chains since 28 August. We will monitor for atomic IOC release from Proofpoint's full report, evidence of financially motivated adoption, and any expansion of targeting into EMEA.

---

[Read the original source →](https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*