Adversary Intelligence — 2026-09-12

Four Chinese Espionage Groups Exploit BlueMoon Zero-Day Chain Targeting US NGOs, Aerospace and Commodity Firms

BLUFChina's shared exploit-kit model now arms multiple espionage teams simultaneously, collapsing the patch-gap window into a coordinated threat that outpaces standard enterprise update cycles.

Proofpoint reported that at least four state-aligned threat groups, most assessed as China-nexus, chained three zero-day vulnerabilities in a kit it calls BlueMoon beginning August 28 1. TA412 (also tracked as APT31, Violet Typhoon, JungleBamboo) struck first on August 28, targeting US NGOs, mining companies and commodity traders with phishing lures installing a malicious browser extension named GemStone, disguised as Google Gemini and functioning as a credential-theft and surveillance backdoor 12. Three additional clusters followed within days: UNK_LateNight hit US aerospace and defense firms on September 2 with the ShadowPad backdoor via DLL-sideloading, UNK_DoubleCheck targeted a Vietnamese manufacturer the same day via a compromised Southeast Asian government email account, and UNK_QuietRacket targeted government, consulting and financial-sector organizations in Indonesia and Singapore on September 3 123. The kit combined two Chromium V8 flaws (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC privilege-escalation bug (CVE-2026-85880), exploiting a roughly four-week gap between the public Chromium patch and its rollout to stable Chrome releases 13. Proofpoint researcher Mark Kelly said the code across all four actors was "practically identical," including variable naming and comments, and that Proofpoint has directly observed fewer than 20 targeted organizations globally to date 24.

Analysis
The near-identical code across four separate operator sets indicates a shared exploit-kit supplier rather than independent development, pointing to a commercial or state-run distribution channel serving multiple Chinese espionage services simultaneously. That model compresses the time between a public Chromium patch and mass exploitation, since a single builder can re-arm and redistribute the chain to several customers within days of disclosure. Defenders relying on Chrome's standard rollout cadence, rather than the Chromium source patch date, are exposed during a window attackers now treat as routine tradecraft. AI-assisted debugging artifacts in the kit's comments indicate the reverse-engineering effort required to weaponize patch-gap bugs is shrinking across the exploit-development ecosystem.

4 sources

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days - Proofpoint
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit - The Record
New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws - BleepingComputer
Chinese espionage groups swarm to exploit triple-link chain of zero-days - CyberScoop