Four Hacking Groups Deploy Identical BlueMoon Exploit Kit Targeting Chrome Patch Gap

At least four distinct cyber-espionage factions, including several with documented ties to Chinese state intelligence, have deployed a newly discovered exploit kit to target vulnerabilities in Google Chrome and Windows systems. Cybersecurity firm Proofpoint revealed that the toolkit, tracked as BlueMoon, was actively leveraged in attacks beginning in late August and continuing into September. Researchers found that the campaigns targeted high-profile sectors, including United States defense contractors, non-governmental organizations, mining companies, commodity traders, and foreign government agencies across Southeast Asia.

The widespread distribution of a single, highly sophisticated exploit kit across otherwise separate threat actors underscores a significant shift in modern cyber-attack methodologies. According to Proofpoint, the observed campaigns utilized identical codebases, complete with matching variable naming and internal commentary, ruling out parallel development by independent groups. The toolkit chains three distinct vulnerabilities together: two residing in Google's open-source V8 JavaScript engine for remote code execution, and a third operating as a local privilege escalation in older versions of the Windows kernel.

The BlueMoon kit relies on a triad of flaws to compromise victim machines and hand off execution to payloads chosen by individual hacking units. The browser component exploits a V8 type confusion bug alongside a separate V8 sandbox escape. Once execution is achieved inside the browser environment, the kit bridges to a local privilege escalation vulnerability found within older versions of the Windows operating system, including Windows 10, Windows Server 2019, Windows Server 2022, and initial releases of Windows 11.

Despite the sophistication required to chain browser and kernel bugs, researchers noted that the final payload delivery mechanism displayed unexpected operational crudeness. Rather than utilizing covert staging protocols, the operators employed the standard curl command-line utility to download malicious files directly into temporary system directories. Cybersecurity analysts attribute this relative sloppiness to a frantic rush to operationalize the exploit before target organizations could apply pending software updates.

The rapid weaponization of the underlying flaws was directly facilitated by what security analysts term a patch gap in the Chromium software ecosystem. The V8 bugs exploited by BlueMoon had actually been addressed and patched in the public upstream Chromium source code in early August. However, those security fixes required roughly four weeks to propagate downward into stable, publicly available releases of the Google Chrome web browser and other Chromium-based platforms.

This delay provided threat actors with a critical window of opportunity to examine public code repositories, reverse-engineer the applied security patches, and construct functional exploit code before end users received the update. "Historically, that four-week gap has been pretty reasonable," Mark Kelly, a threat researcher at Proofpoint, said in an interview with Recorded Future News, noting that reverse-engineering and weaponizing a patch within that timeframe had previously been rare. "That seems to no longer be the case."

Investigators uncovered strong indicators that artificial intelligence tools may have played a role in accelerating the creation of the BlueMoon toolkit. Analysis of the exploit code revealed debugging comments closely mirroring dialogue structures generated by AI assistants, alongside internal references to context-management documents used across multiple sessions. Analysts suggest that threat actors increasingly leverage AI models to parse open-source codebases and rapidly synthesize functional exploits from public patch disclosures.

the code included explicit references to Google's V8 bug-bounty challenge, pointing to the possibility that the developers may have framed their reverse-engineering work as legitimate security research while testing the exploit structure. "People on Twitter are reverse-engineering these Chromium patches to develop working exploits using AI," Kelly said. "It's pretty good at it, because it's open-source code."

The campaigns orchestrated by the four identified groups demonstrated divergent operational objectives and target profiles, confirming that the actors operated independently despite sharing the BlueMoon infrastructure. The first observed group, TA412, also tracked under aliases such as APT31, Violet Typhoon, and RedBravo, initiated attacks on August 28 targeting United States NGOs, mining operations, and commodity trading firms. TA412 deployed a malicious browser extension disguised as Google's Gemini AI assistant to facilitate surveillance and credential theft.

A second faction, designated UNK_LateNight, focused its operations on United States aerospace and defense corporations, delivering the ShadowPad backdoor. A third group, UNK_DoubleCheck, targeted a Vietnamese manufacturing entity by leveraging a compromised Southeast Asian government email account paired with a fake vaccination appointment lure. A fourth group, UNK_QuietRacket, directed attacks against government, financial, and consulting organizations across Indonesia and Singapore.

While three of the four groups possess established links to Chinese state-sponsored activity, the exact supply chain through which the BlueMoon toolkit was distributed remains undetermined. Investigators have floated several working theories, including the possibility that a private contractor developed the exploit kit and sold licenses to multiple state-backed clients, mirroring historical distribution models observed with commercial surveillanceware and modular backdoors like ShadowPad.

"It's such a tangled web," Kelly said regarding the origin of the shared tooling. "It's very difficult to unpick." Meanwhile, tech platforms are moving to close the systemic timing windows that enabled the campaign. Google began implementing a shortened two-week release cycle for Chrome to accelerate the deployment of security patches, while software vendors issued emergency updates addressing the exploited vulnerabilities across affected browser and operating system environments.