> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week - URL: https://f4n6.co.uk/security-feed/four-spy-groups-used-the-same-chrome-and-windows-exploit-kit-within-a-week/ - Published: 2026-09-09T21:28:10.000Z - Updated: 2026-09-09T21:28:10.000Z - Author: Jeff Davies - Tags: #security-feed, APT31, Bronze Vinewood, Judgement Panda, JungleBamboo ## 1\. Executive summary Proofpoint reports that at least four espionage-motivated threat clusters — the majority with a suspected China nexus — deployed a previously undocumented exploit kit, tracked as **BlueMoon**, within days of its first observed use on 28 August 2026\. BlueMoon chains a type-confusion flaw in Chrome's V8 engine (CVE-2026-85046), an unassigned V8 sandbox escape, and a Windows ALPC heap-based buffer overflow (CVE-2026-85880) to achieve code execution, escape the browser sandbox, elevate privileges, and inject operator-specified payloads. Both V8 flaws were "patch-gap" zero-days — fixed in public upstream Chromium source but not yet in stable browser releases — indicating the kit's developer monitors public Chromium patches. EMEA financial services clients should treat this as an active, targeted espionage threat delivered via spear-phishing to high-value individuals; both CVEs are now patched (Google and Microsoft September 2026 Patch Tuesday respectively) and patching is the primary control. Attribution of the first use to APT31 is corroborated by reporting, but the aliases Bronze Vinewood, Judgement Panda and JungleBamboo carry no MITRE ATT&CK profile in our verified data and should be treated as unconfirmed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Exploitation is confirmed in the wild by multiple state-aligned espionage clusters against NGO, mining and commodity-trading targets via phishing, with sandbox escape and host-level payload delivery — a candidate major incident if a client environment is compromised | If BlueMoon delivery or GemStone-style persistence is detected on a client network, the incident classification process (Art. 18) must run immediately and, if thresholds are met, major-incident reporting clocks under Art. 19 start from detection, not from confirmation of data loss | | DORA Art. 24: digital operational resilience testing — general requirements | The kit exploits a patch-gap window between upstream Chromium fixes and stable browser releases, which routine patch-level testing would not have covered | Clients should add patch-gap exposure (upstream-fixed, stable-unfixed) to vulnerability-management scope and threat-led penetration testing scenarios, not just CVE-scan-based testing | No NIS2 or UK NIS article is directly engaged by the facts in this item beyond generic incident-response duties; we do not force the mapping. ## 3\. Technical analysis & attack chain ### Confirmed attack chain (per Proofpoint, corroborated by The Record) 1. **Initial access — spear-phishing.** The actor sends a phishing email tricking the target into clicking a link to an actor-controlled URL. APT31's August 2026 activity used lures targeting NGOs, mining companies, and physical commodity trading firms in the U.S. 2. **Browser exploitation.** The URL serves the BlueMoon exploit kit, which triggers the two V8 flaws in succession: CVE-2026-85046 (type confusion in V8) for initial code execution, then an unassigned V8 sandbox escape. 3. **Host fingerprinting.** Following the Chrome exploits, the kit uses a reflectively loaded DLL to fingerprint the Windows host; the kit's JavaScript uses the fingerprint result to decide whether to attempt the LPE exploit. 4. **Privilege escalation.** A second reflectively loaded DLL runs the LPE exploit against CVE-2026-85880 (heap-based buffer overflow in Windows Advanced Local Procedure Call, ALPC) to elevate the renderer process. 5. **Injection and payload delivery.** With elevated privileges, a separate injector shellcode injects a CreateProcess stub into the parent Chrome broker process, executing an operator-specified command. The default command downloads a remotely hosted executable via a **curl** command and executes it. Payloads vary by threat cluster. **Observed payload (APT31 chain, beginning 28 August 2026):** the downloaded loader executable installs a malicious browser add-on disguised as Google Gemini, using a Chrome extension integrity bypass technique dubbed **GhostChrome-X**. The extension — a browser-surveillance and credential-theft backdoor tracked as **GemStone** — gives the actor a C2 channel to issue commands inside the browser context. This is a credential-theft and surveillance capability, not ransomware; no extortion or encryption behaviour is described in the source material. **Kit variants:** multiple BlueMoon variants have been detected with subtle changes — removed comments, obfuscated components, campaign-specific landing pages and redirects, browser-side OS checks, and additional telemetry. The underlying exploit chain is identical across variants. **Patch-gap detail:** both V8 vulnerabilities were "patch-gap" zero-days at time of exploitation — already fixed in public upstream Chromium source code but not yet propagated to the latest stable Chrome/Chromium-based browser releases. Proofpoint suspects the kit developer closely tracked publicly available Chromium patches to assemble the browser exploit chain. This matters operationally: any Chromium-based browser (not only Google Chrome) that lags upstream is exposed to the same window. ### Attribution and confidence caveats - Attribution of first use to **APT31** is single-sourced to Proofpoint's report (corroborated in outline by The Record's coverage of the same research, but both trace to the one vendor dataset). Treat as high-likelihood but single-vendor. - The aliases **Bronze Vinewood**, **Judgement Panda** and **JungleBamboo** have **no MITRE ATT&CK profile** in our verified reference data; attribution under those names is unconfirmed. The Hacker News also lists PerplexedGoblin, RedBravo, TA412, Tide Castle and Violet Typhoon as APT31 aliases; we cannot verify these mappings. - Proofpoint explicitly states BlueMoon "may not be exclusive to China-aligned actors, as some usage remains unattributed and there are potentially more actors using the exploit kit." Do not scope detection or threat hunting to China-nexus indicators alone. - The source material was truncated mid-description of the UNK\_LateNight cluster (observed from 2 September 2026); details of that and any further clusters beyond the APT31 chain are not available to us and we do not speculate. ## 4\. Mitigation & containment ### P1 — within 24 hours - **Patch Chrome/Chromium now.** CVE-2026-85046 was patched by Google "last week" relative to 9 September 2026 publication; confirm all managed endpoints run the fixed stable build. Extend the check to every Chromium-based browser in the estate (Edge, Brave, Vivaldi, in-house Chromium forks) — the patch-gap mechanism means non-Google Chromium browsers may lag. - **Patch Windows.** CVE-2026-85880 (ALPC heap-based buffer overflow) was addressed in Microsoft's September 2026 Patch Tuesday. Confirm the September cumulative update is applied estate-wide; prioritise workstations, as the LPE target is the Chrome renderer on interactive hosts. - **Hunt for the delivery pattern.** Search endpoint telemetry for the default payload mechanism: `curl` process executions spawned by or injected from Chrome broker/parent processes, and unexpected child processes of the Chrome broker. Any hit on a user reporting a phishing link since 28 August 2026 should be treated as presumed-compromised pending review. - **Contain confirmed hits:** isolate the host, capture memory and browser profile data (extension list, preferences, local storage) before reimaging, and rotate credentials/sessions for all accounts authenticated in the affected browser profile — GemStone is a credential-theft backdoor and session cookies are prime targets. ### P2 — within 72 hours - **Audit browser extensions estate-wide** for unexpected or newly installed add-ons, particularly anything presenting as Google Gemini or otherwise unrecognised. Review enterprise extension allow-lists and enforce extension installation policy (block sideloading/untrusted extensions) to counter the GhostChrome-X integrity-bypass technique. - **Brief high-value staff.** The observed targeting profile (NGOs, mining, physical commodity trading) sits adjacent to financial-services interests in commodities and trade finance; warn executives, traders, and anyone with commodity-market exposure against clicking links from unsolicited email, and ensure reporting channels are live. - **Review egress controls** for `curl`\-initiated outbound downloads from workstations where not business-required; application allow-listing or EDR policy can block the default payload retrieval step. ### P3 — within 7 days - **Add patch-gap monitoring to vulnerability management.** Track upstream Chromium security fixes that are not yet in your deployed stable browser versions, and shorten the window between upstream fix and stable-channel deployment. This is the control failure this kit specifically monetises. - **Update threat-led penetration testing scenarios** (DORA Art. 24) to include browser exploit-chain delivery via phishing link and extension-based persistence. - **Re-run phishing simulation and link-isolation controls** against the observed pattern: email → actor-controlled URL → browser exploit. Consider enabling browser isolation or link detonation for suspicious URLs in email. ## 5\. Indicators of compromise No atomic indicators of compromise (domains, IPs, hashes, URLs) are present in the source material provided. The sources describe observable behaviours only. ### Behavioural indicators | Behaviour | Where to observe | Confidence | | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | curl download-and-execute spawned via injected CreateProcess stub in the Chrome broker process | EDR / process telemetry: child processes of Chrome broker, command lines containing curl with remote URL | High (per Proofpoint) | | Reflectively loaded DLLs running in the Chrome renderer post-exploitation (fingerprinting, then LPE) | EDR reflective-load / module-load telemetry on Chrome renderer processes | High (per Proofpoint) | | New browser extension installed presenting as Google Gemini (GemStone backdoor, GhostChrome-X integrity bypass) | Browser extension inventory, Chrome preferences/local storage, enterprise extension management logs | High (per Proofpoint, APT31 chain) | | Spear-phishing email containing link to actor-controlled URL serving the exploit kit | Email gateway logs, user-reported phish, URL detonation telemetry | High (per Proofpoint) | | Campaign-specific landing pages and redirects with browser-side OS checks | Web proxy / DNS logs for users clicking through from phishing email | Medium (per Proofpoint; no specific URLs published) | ## 6\. Detection The sources provide no file hashes, C2 domains, or distinctive strings from the malware binaries themselves. However, the described behaviours — `curl` execution from the Chrome broker process, and a Chrome extension named/presenting as Google Gemini — are concrete, source-supported artefacts suitable for behavioural detection. ```yara /* No YARA rule emitted: the source material contains no file-based artefacts (hashes, strings, mutexes, or embedded constants) from the BlueMoon kit, the GemStone extension, or its payloads. A rule built from product names or CVE identifiers would detect reporting about the threat, not the threat. */ ``` ```yaml title: Suspicious curl Execution from Chrome Broker Process - BlueMoon Default Payload id: 7c1f2a44-8b3e-4d19-9f6a-2e5c8d1b0a73 status: experimental description: > Detects the BlueMoon exploit kit default post-exploitation behaviour: an injector shellcode injects a CreateProcess stub into the parent Chrome broker process, which executes an operator-specified command that by default downloads a remotely hosted executable via curl and executes it. Reference: Proofpoint via The Hacker News, 2026-09-09. references: - https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html author: Adverse Trace date: 2026-09-09 logsource: category: process_creation product: windows detection: selection_parent: ParentImage|endswith: '\chrome.exe' selection_cmd: Image|endswith: '\curl.exe' CommandLine|contains: 'http' condition: selection_parent and selection_cmd falsepositives: - Legitimate curl usage initiated from Chrome (e.g., developer tooling); validate URL and destination reputation level: high ``` ```yaml title: Chrome Extension Presenting as Google Gemini - GemStone Backdoor Pattern id: 3a9d5e12-6f4b-4c28-b7e1-9d0a4c5f8e21 status: experimental description: > Detects installation or presence of a malicious Chrome extension disguised as Google Gemini, installed via the GhostChrome-X extension integrity bypass by the APT31 loader executable. Observed in BlueMoon activity beginning 2026-08-28. references: - https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html author: Adverse Trace date: 2026-09-09 logsource: category: file_event product: windows detection: selection: TargetFilename|contains: '\Google\Chrome\User Data\Default\Extensions\' TargetFilename|contains: 'gemini' condition: selection falsepositives: - Legitimate Google Gemini extension installed from the Chrome Web Store; verify extension ID and install source level: high ``` ## Threat actor context **ZIRCONIUM** · [G0128](https://attack.mitre.org/groups/G0128?ref=f4n6.co.uk) · aka APT31, Violet Typhoon [ZIRCONIUM](https://attack.mitre.org/groups/G0128?ref=f4n6.co.uk) is a threat group operating out of China, active since at least 2017, that has targeted individuals associated with the 2020 US presidential election and prominent leaders in the international affairs community. *No MITRE ATT&CK profile for: Bronze Vinewood, Judgement Panda, JungleBamboo.* ## 7\. Sources - The Hacker News — *Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week* — https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html — 2026-09-09 - The Record (Recorded Future) — *Multiple Chinese hacking groups seen using identical Chrome zero-day exploit* — https://therecord.media/china-hackers-chrome-browser-zero-day-multiple-groups — September 2026 (corroborating coverage of the same Proofpoint research) ## 8\. Adverse Trace position BlueMoon is a competent, rapidly proliferating espionage exploit kit whose defining operational feature is the exploitation of the Chromium patch gap — it weaponises fixes that exist upstream but have not reached stable browser builds, which defeats CVE-driven patch compliance alone. Severity for EMEA financial services is **high but targeted**: the observed victimology (NGOs, mining, commodity trading) is adjacent to commodities and trade-finance interests, and the GemStone payload is a credential-theft and browser-surveillance backdoor — exactly the capability needed for session hijacking against banking and trading platforms. Attribution of first use to APT31 rests on a single vendor's dataset (Proofpoint, echoed by The Record) and the alias set including Bronze Vinewood, Judgement Panda and JungleBamboo is unconfirmed in our verified reference data; the kit is also explicitly not exclusive to China-aligned actors, so hunting must be behaviour-based, not actor-based. Both exploited CVEs are patched as of the September 2026 patch cycles; clients who have applied Google's and Microsoft's September updates and enforce extension policy are materially protected. We will monitor for the full Proofpoint report, the truncated UNK\_LateNight cluster details, publication of atomic IOCs, and any evidence of BlueMoon use against European financial-sector targets, and will reissue this advisory if verified indicators emerge. --- [Read the original source →](https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*