Four groups exploited same Chrome/Windows exploit kit
Original: Four groups caught using the same Chrome and Windows exploit kit
Why This Matters
AI-accelerated exploit development is eroding the traditional exclusivity of browser zero-days, widening threat actor access.
Proofpoint researchers found four hacking groups — including a China-linked state actor — using an identical exploit kit called BlueMoon that chains two Chromium V8 bugs and one Windows kernel flaw. All three vulnerabilities were patched within 24 hours of disclosure. The first attack began August 28, 2026.
Security firm Proofpoint disclosed Wednesday that at least four threat actors shared a nearly identical exploit kit, dubbed BlueMoon, targeting critical vulnerabilities in Chromium-based browsers and older Windows versions. The kit chains two flaws in V8, Google's JavaScript engine, with a Windows kernel vulnerability affecting Windows 10, Windows 11 (initial release), Windows Server 2019, and Windows Server 2022. All three received patches within the past 24 hours.
Proofpoint identified the four groups: TA412, a China-aligned actor indicted by the US in 2024 for espionage on behalf of China's civilian foreign intelligence agency, hit NGOs, mining companies, and commodity trading firms in the US. UNK_LateNight, also China-aligned, targeted US aerospace companies. UNK_DoubleCheck hit a Vietnamese manufacturer. UNK_QuietRacket focused on Singapore and Indonesia. TA412's attacks started August 28; the others followed in early September.
Proofpoint flagged two structural reasons for the unusually broad, rapid sharing of a high-value exploit chain. First, Chromium's open-source patch gap — the delay between upstream fixes and downstream browser releases — gave attackers a window to reverse-engineer patches before Chrome or Edge shipped them. Second, AI-assisted vulnerability discovery is compressing that window further, lowering the cost and skill bar for building browser exploit chains. 'A fully weaponized Chrome exploit chain has historically been a high-value, rare capability,' Proofpoint wrote, adding that this case 'may reflect a reduced cost and barrier to entry.'