Security1 publisher2 min readPublished
BlueMoon exploit kit spread to four espionage crews within a week of APT31's first use
Proofpoint says four espionage clusters were running the same undocumented Chrome and Windows exploit chain within a week of its debut, which puts the pacing of browser patching in the hands of whoever ships the kit.
The Watch · Security desk
What happened
- Proofpoint documented a previously undocumented exploit kit called BlueMoon that chains two Google Chrome V8 flaws with a heap overflow in Windows Advanced Local Procedure Call.
- The first in-the-wild use was attributed to China-aligned APT31 on August 28, 2026, against U.S. non-governmental organizations, mining companies and physical commodity trading firms.
- UNK_LateNight began spear-phishing U.S. aerospace companies and UNK_DoubleCheck a Vietnamese manufacturer on September 2, both delivering their payloads through the same kit.
- Google patched CVE-2026-85046 last week and Microsoft fixed the ALPC bug CVE-2026-85880 in its September 2026 Patch Tuesday; the V8 sandbox escape in the chain has no assigned CVE.
- Variants of the kit differ in stripped comments, obfuscation, campaign-specific landing pages, browser-side operating system checks and telemetry, while the exploit chain underneath is unchanged.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- capability Clusters that would have to build a V8 sandbox escape in house are now fielding one within days of another crew's debut, so kit access, not exploit development, sets what a mid-tier espionage group can reach.
- decision For anyone sequencing this month's work, the browser update is the load-bearing one: the Windows patch alone leaves the first two links of the chain usable.
- constraint A Chrome patch clock measured from vendor advisories runs behind the source tree an exploit developer reads, which shortens the useful window for staged browser rollouts across a fleet.
- contradiction The count of four crews is a floor rather than a census, because Proofpoint says some usage remains unattributed and more actors may be on the kit.
Order matters in this chain, and the order is fixed. The phishing link lands the target on an actor-controlled URL, where CVE-2026-85046 gives code execution in the Chrome renderer and the second V8 bug, the one with no CVE, gets the operator out of the renderer sandbox [5][9]. Only then does the kit reflectively load a DLL to fingerprint the Windows host, and the kit's JavaScript uses that fingerprint to decide whether to attempt the privilege escalation at all, according to the Proofpoint researchers who wrote it up [10]. A second reflectively loaded DLL runs the ALPC overflow to elevate the renderer, an injector shellcode plants a CreateProcess stub in the parent Chrome broker process, and the default operator command pulls a remote executable with curl and runs it [11].
APT31 was firing the ALPC bug at hosts with no fix available. The first observed use was August 28, and the Windows patch did not arrive until Microsoft's September cycle [2].
The browser half is the more instructive part. Proofpoint found both V8 bugs were patch-gap zero-days, already fixed in public upstream Chromium source when they were exploited but not yet propagated into stable Chrome or the Chromium-based browsers downstream of it [7]. Proofpoint suspects the kit's developer was following those public patches to assemble the browser chain [8]. On that reading, the exposure window was opened by a commit rather than by a discovery. The sandbox escape also still carries no CVE identifier, so patch-state reporting has nothing to key on for that link [4].
Then the handoff. UNK_LateNight and UNK_DoubleCheck were on the same kit five days after APT31's first use [1]. What they share is the access chain; the implants diverge. APT31's loader installed a browser add-on posing as Google Gemini through a Chrome extension integrity bypass Proofpoint calls GhostChrome-X, delivering a surveillance and credential-theft backdoor named GemStone with its own C2 channel [13]. UNK_LateNight sideloaded a DLL to run ShadowPad [14]. UNK_DoubleCheck served the kit from an actor-controlled Cloudflare Workers domain and sideloaded to a Rust binary [15].
That is three sets of indicators behind one delivery mechanism. Detection tuned to the payloads reads this as three unrelated intrusions, and the exploit chain is the only artefact common to all of them [9].
What to watch
- Whether the un-CVE'd V8 sandbox escape gets an identifier and a dated fix in the stable channel.
- Whether BlueMoon turns up with an operator that has no China nexus, which would point at a broker rather than a shared state supply.
- Whether later variants drop phishing for compromised-site delivery and take the victim click out of the chain.