BlueMoon is a newly observed exploit kit that multiple espionage groups rapidly adopted to chain Chrome zero-days and a Windows privilege escalation flaw in rushed, opportunistic attacks. Proofpoint says it was first used by Violet Typhoon and then shared across other threat actors targeting organizations in the US, Vietnam, Indonesia, and Singapore, possibly with AI-assisted development. #BlueMoon #VioletTyphoon #APT31 #UNK_LateNight #UNK_DoubleCheck #UNK_QuietRacket #CVE-2026-85046 #CVE-2026-87491 #CVE-2026-85880
Keypoints
- BlueMoon is a new exploit kit used by multiple espionage groups.
- It chains two Chrome zero-days and one Windows privilege escalation flaw.
- Violet Typhoon was the first group observed using BlueMoon.
- Other threat actors quickly used it against targets in the US and Asia.
- Proofpoint says AI may have helped build and spread the kit.
Read More: https://www.securityweek.com/bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days/