Four state-backed espionage groups quickly deployed the BlueMoon exploit kit, chaining Chrome and Windows vulnerabilities to take over browsers and entire systems by exploiting a critical patch gap in Chrome's stable release.
Attackers moved fast and openly. Within days, four state-aligned espionage groups began using BlueMoon, a modular exploit kit that chained two Chrome vulnerabilities with a Windows kernel zero-day. Their targets were systems that appeared fully patched and current.
BlueMoon worked because the fixes for the Chrome bugs were already public in the Chromium source code, but hadn't yet reached the stable Chrome release most organizations use. This left a window of nearly a month where attackers could study the open-source changes, rebuild the exploit, and strike before the official update reached users.
How BlueMoon works and who used it
Proofpoint first saw BlueMoon in action on 28 August 2026, deployed by TA412-also known as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE-against US NGOs, mining companies, and commodity traders. Volexity, another threat intelligence firm, tracked a separate group, UTA0560, using the same kit days later with donation-themed lures aimed at NGO donors. Two more China-aligned clusters, UNK_LateNight and UNK_QuietRacket, quickly followed, targeting US aerospace and defense firms as well as government and financial organizations in Indonesia and Singapore.
BlueMoon isn't a custom tool for one group. It's a shared, modular platform that several crews used for their own campaigns, all relying on the same exploit chain. The kit uses three vulnerabilities: CVE-2026-85046, a type-confusion bug in Chrome's V8 JavaScript engine; CVE-2026-87491, which corrupts WebAssembly data to escape the V8 sandbox and run shellcode; and CVE-2026-85880, a Windows kernel local privilege escalation zero-day compiled in 2025, which lets attackers move from browser access to full system control. Independent analyses confirm this exploit chain was used in attacks against NGOs, aerospace, defense, financial, and government targets, showing how widely BlueMoon was deployed across critical sectors.
La catena di exploit BlueMoon sfrutta tre vulnerabilità distinte: una nel motore V8 di Chrome, una nell'isolamento sandbox tramite WebAssembly e una escalation di privilegi nel kernel di Windows. Questa combinazione permette agli attaccanti di passare dal browser al pieno controllo del sistema.
The critical role of Chrome's patch gap
Both Chrome vulnerabilities had already been disclosed and fixed in the open Chromium repository, but the stable Chrome build lagged behind. The patch for CVE-2026-85046 was committed on 7 August but didn't reach stable users until 3 September, leaving almost four weeks of exposure. During this time, BlueMoon exploited a bug that was technically "fixed" but not yet delivered to real-world machines. This isn't a one-off: attackers have repeatedly taken advantage of similar windows in recent zero-day campaigns, as reported earlier on QWERTYmag.
Independent reports point to the real risk: the "patch gap"-the time between a fix being published in Chromium and its arrival in the stable Chrome channel. This window let attackers reverse-engineer the exploit and use it before organizations could update. The Windows kernel bug, CVE-2026-85880, was a true zero-day, not previously disclosed or patched, and was added to BlueMoon to ensure browser compromise led straight to full machine takeover. Both Proofpoint and Volexity provided indicators of compromise, noting that BlueMoon leaves a clear process trail: chrome.exe spawning cmd.exe, then curl.exe fetching a loader into the %TEMP% directory.
Operational implications and recommendations
For defenders, the lesson is clear. Open-source patching moves faster than stable update deployment, creating a recurring window of vulnerability. Security teams need to check how quickly their Chrome stable channels get updates after a Chromium fix, whether patch schedules are centrally managed, and if CVE-2026-85880 is addressed on older Windows builds. The BlueMoon case shows attackers aren't waiting for hidden bugs-they're exploiting the lag between public fixes and real-world protection, and a shared exploit kit can spread the threat across multiple groups in days.
BlueMoon's rapid use by four espionage crews is a warning for organizations that think they're "up to date." The real risk isn't unknown vulnerabilities, but the predictable delay between open-source disclosure and endpoint patching. Until that gap closes, attackers will keep exploiting it for high-impact breaches, and defenders need to adapt their strategies to match the speed and coordination of modern threat actors. For further guidance, organizations can review the ACN patch management guidelines to align with national cybersecurity best practices.
