Summary Points
- Multiple espionage groups, primarily China-aligned, are deploying the BlueMoon exploit kit to chain vulnerabilities in Windows and Chrome, enabling code execution, sandbox escape, and payload delivery through spear-phishing and DLL sideloading.
- BlueMoon leverages recent zero-day vulnerabilities (CVE-2026-85046 in Chrome and CVE-2026-85880 in Windows) to infect targets, with malware often using AI-assisted code to enhance development and evade detection.
- The exploit chain results in persistent backdoors such as GemStone and malicious browser extensions, with infection signs including suspicious process trees, files, scheduled tasks, and registry keys, despite browser patches.
Threat Overview, Attack Techniques, and Targets
Multiple spy groups have used a new exploit kit called BlueMoon within a week. This exploit kit chains together several vulnerabilities in Microsoft Windows and Google Chrome. The first known use was by the China-aligned group APT31 on August 28, 2026. After that, other espionage groups also started using BlueMoon.
The attack begins with phishing emails. The emails trick targets into clicking malicious links. These links open a website controlled by the attackers. The website triggers two vulnerabilities in the Chrome browser. These are CVE-2026-85046, a vulnerability in Chrome’s V8 engine, and CVE-2026-85880, a Windows buffer overflow. Google recently patched the Chrome vulnerability, but not all users may have updated yet.
The exploit kit also takes advantage of a Chrome sandbox escape, which is not assigned a specific CVE. After exploiting the browser, the attacker uses another exploit to get higher privileges on the Windows system. The malware then downloads additional payloads depending on the threat group. Targets include non-governmental organizations, mining companies, aerospace companies, manufacturing firms, and government institutions, mainly in the U.S., Indonesia, and Singapore.
Impact, Implications, and Remediation Guidance
This exploit kit is powerful because it can bypass many defenses and gain control of computers quickly. It can lead to data theft, espionage, and system compromise. Because the exploit chain relies on unpatched vulnerabilities, there is a high risk for organizations that do not update their systems.
The presence of AI tools in developing this malware suggests it could be copied or refined easily in the future. The exploit kit’s rapid sharing among threat groups increases its threat level. Organizations should prioritize patching affected systems as soon as possible. Specifically, they should update Google Chrome to the latest version and apply Windows security patches.
The attack also leaves behind signs that can help detection. These include unexpected files in the temporary folder, unusual process trees, and specific registry keys. Security teams should review these indicators if they suspect infection.
If you need assistance with remediation, it is best to contact your software vendor or security authority. They can provide detailed instructions to remove the malware and strengthen defenses.
Discover More Technology Insights
Explore the future of technology with our detailed insights on Artificial Intelligence.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
