GoKawiilBlueMoon exploit kit chains Chrome and Windows zero-days in espionage campaigns
Security researchers at Proofpoint and Volexity uncovered a modular attack tool called BlueMoon that strings together two Chromium browser flaws and a Windows kernel bug to achieve remote code execution and system-level control. The kit has been used since late August by China-linked group JungleBamboo (also known as APT31) and by a separate actor Volexity calls UTA0560, which targeted NGO staff. Analysts believe one of the three vulnerabilities, a Windows ALPC flaw, was repurposed from an existing 2025 exploit rather than newly built.
GoKawiil's interpretation of the reporting above, not reported fact.
BlueMoon shows how espionage groups now share reusable exploit infrastructure rather than building bespoke tools for each campaign, shortening the time between a bug's disclosure and its weaponization. Because the kit exploits the gap between Chromium's public code fixes and Chrome's official patch rollout, it highlights a persistent weakness in how quickly downstream browsers ship security updates. Its use against NGOs alongside state-linked spearphishing also signals that civil society groups remain high-value targets for sophisticated intrusion sets.
- BlueMoon chains two Chrome V8 flaws with a Windows ALPC privilege escalation bug for full system compromise.
- China-linked APT31/JungleBamboo and a separate actor tracked as UTA0560 both deployed the kit in phishing campaigns since late August.
- One flaw appears recycled from a 2025 exploit, suggesting attackers repackage older capabilities into new shared tooling.
Yubico YubiKey 5C NFC Security Key — Spearphishing campaigns like the ones delivering BlueMoon usually start with stolen or tricked credentials, and a hardware security key makes phishing-resistant sign-in the default. The YubiKey 5C NFC works over USB-C or by tapping on a phone, so you can lock down Google, Microsoft, and password manager accounts across your devices.
See Yubico YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-10
Published there as: “New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.