Four hacking groups simultaneously exploited same Chrome and Windows exploit kit within days of patch release

Security researchers at Proofpoint reported that at least four distinct hacking groups simultaneously deployed a newly disclosed exploit kit named BlueMoon within days of patches being released for two Chromium and one Windows kernel vulnerability.

BlueMoon chains three vulnerabilities: a V8 type confusion bug (CVE-2026-85046), a V8 sandbox escape, and a Windows local privilege escalation (CVE-2026-85880) affecting Windows 10 (Oct. 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11.

Proofpoint said the exploit kit was rapidly shared and used at scale, leaving detectable signals, likely due to a patch gap in the Chromium supply chain and the accelerating pace of AI-assisted vulnerability discovery. The researchers noted that AI can often spot vulnerabilities faster than human-only discovery, compressing the time between patch availability and exploit deployment.

The four groups targeted a range of organizations and sectors. TA412, a China-aligned state-sponsored actor indicted in 2024, repeatedly hit US-focused NGOs, mining companies, and physical commodity trading firms. UNK_LateNight, another China-aligned espionage group, targeted multiple US aerospace companies. UNK_DoubleCheck targeted a Vietnamese manufacturing entity, and UNK_QuietRacket activity targeted entities in Singapore and Indonesia.

The first attack began on August 28, with additional campaigns starting earlier in September. Proofpoint did not say whether other groups also gained access to the kit. The researchers warned that, given its ease of adoption, BlueMoon may continue to proliferate among espionage-motivated and financially motivated actors even after patched versions are fully rolled out across Chromium-based browsers.