Four espionage crews, most China-linked, ran the same Chrome exploit kit through a four-week patch gap

Proofpoint's evidence for the sharing is the code itself. Mark Kelly, a threat researcher at the company, told Recorded Future News the code is practically identical across the intrusions, including variable naming and commentary, and that parallel development is not a possibility: "It's the same kit. One hundred percent." ^[5] Below the kit, the operations diverge. Proofpoint says each group pursued different targets and ran its own malware and command-and-control infrastructure. ^[4]

TA412, also tracked as APT31, Violet Typhoon and RedBravo, was the first group seen using the kit, at the end of August. ^[14] It ran fake internship inquiries and messages about an Asian Studies conference against US NGOs, mining companies and commodity traders, then installed a malicious browser extension disguised as Google's Gemini assistant that Proofpoint describes as a browser-surveillance and credential-theft backdoor. ^[16] UNK_LateNight sent fake procurement inquiries to US aerospace and defense companies and installed ShadowPad. ^[17] UNK_DoubleCheck hit a Vietnamese manufacturer and UNK_QuietRacket hit organizations in Indonesia and Singapore, according to SC Media's account of the research. ^[18] TA412 is the group whose alleged operators US authorities indicted in 2024, alongside sanctions on a Wuhan-based company believed to be a front for China's Ministry of State Security. ^[15]

Chromium is open source, so the interval between a fix landing there and arriving on stable Chrome is a period in which anyone can read the commit, work out which bug it closed, and build an exploit before users are covered. ^[7] Kelly said four weeks had historically been a reasonable margin, because reverse-engineering and weaponizing a patch that fast was rare, and that this is no longer the case. ^[8] The two-week cadence takes that study window from 28 days to roughly 14, which halves it rather than closing it. ^[21]

The handoff at the end of the chain is where the kit gets cheap. Proofpoint calls that step surprisingly crude - curl pulling a malicious file into a temporary folder - and says it gives security software multiple opportunities to detect the attack. ^[11] Kelly attributes the sloppiness to the race to use the exploit before the patch reached Chrome users. ^[12]

Proofpoint documents that the kit moved between groups, not how it moved. Its researchers raise state supply, a shared contractor and a broader commercial market as the possibilities, and note that separate China-linked groups acquiring the same offensive tooling at about the same time is a recurring pattern. ^[13] Two further groups are believed to have used BlueMoon, which would put the count at six, and Proofpoint expects other companies to publish on the campaign. ^[3][20] Neither account attaches a CVE to the two browser flaws or the Windows vulnerability, so the kit name is the only handle defenders currently have. ^[22]