Proofpoint - GoKawiil

BlueMoon exploit kit chains Chrome and Windows zero-days in espionage campaigns

Security researchers at Proofpoint and Volexity uncovered a modular attack tool called BlueMoon that strings together two Chromium browser flaws and a Windows kernel bug to achieve remote code execution and system-level control. The kit has been used since late August by China-linked group JungleBamboo (also known as APT31) and by a separate actor Volexity calls UTA0560, which targeted NGO staff. Analysts believe one of the three vulnerabilities, a Windows ALPC flaw, was repurposed from an existing 2025 exploit rather than newly built.

bleepingcomputer.com · 2026-09-10

BlueMoon exploit kit chaining Chrome and Windows flaws used by four hacker groups

Proofpoint identified an exploit toolkit, dubbed BlueMoon, that chains two Chromium vulnerabilities with a Windows kernel flaw to deploy malware on victims' machines. At least four separate hacking groups, some linked to the Chinese government, have deployed the kit within days of each other, and all three underlying vulnerabilities have only just received patches.

arstechnica.com · 2026-09-09

Proofpoint Nears Deal to Acquire Data-Security Firm Varonis

Proofpoint, owned by private equity firm Thoma Bravo, is reportedly in advanced negotiations to acquire cybersecurity company Varonis Systems. News of the talks sent Varonis shares sharply higher, reflecting its roughly $5 billion market valuation.

wsj.com · 2026-09-02