What happened
On September 9, 2026, Proofpoint published research identifying four espionage-motivated threat actors using the BlueMoon exploit kit. Proofpoint first observed TA412 using BlueMoon on August 28, 2026. Beginning on September 2, 2026, UNK_LateNight and UNK_DoubleCheck used BlueMoon in separate campaigns. Google’s September 3, 2026 stable-channel update addressed CVE-2026-85046 after the upstream fix had been public since August 7, 2026. Microsoft’s September 8, 2026 security release fixed CVE-2026-85880.
BlueMoon chains CVE-2026-85046 in Chrome’s V8 engine, an unnumbered V8 sandbox escape and Windows kernel elevation-of-privilege vulnerability CVE-2026-85880. Proofpoint documented the Windows privilege-escalation stage targeting builds 17763, 19041–19045, 20348 and 22000. The exploit fingerprints the host, elevates the renderer, injects execution into the Chrome broker process and runs an operator-specified command outside the browser sandbox.
BlueMoon’s default post-exploitation command uses curl -sS -o “%TEMP%\msgbox.exe” “
The four clusters pursued different targets and delivered different payloads, including GemStone and ShadowPad. The common exploit orchestration and code led Proofpoint to assess that the builds originated from the same source, although the distribution mechanism remains unresolved. Attribution posture: Proofpoint linked TA412 and UNK_LateNight to China-aligned espionage, assessed UNK_QuietRacket as suspected China-aligned, and left UNK_DoubleCheck unattributed.
Why this matters now
BlueMoon is operational evidence that attackers can exploit a downstream patch gap: an upstream Chromium correction was publicly visible before the stable browser release reached users. Vulnerability programmes that measure compliance only against vendor release dates may miss the period during which public code changes expose enough information for rapid exploit development.
Proofpoint observed multiple distinct espionage clusters adopting nearly identical exploitation code within days, while using different targets, infrastructure and payloads. That pattern increases the decision value beyond a single campaign. Defenders must account for transferable offensive capability that can appear in several intrusion sets without assuming one shared command structure or one uniform attribution.
The chain moves from browser exploitation into SYSTEM-level execution and then campaign-specific malware. In TA412 activity, GemStone could capture browser cookies, storage, keystrokes, sessions and screenshots. A browser update alone therefore cannot close hosts that already executed the post-exploitation stages or received a malicious extension.
The decision for security leaders
Prioritise the intersection of browser state and Windows build, rather than broadcasting an undifferentiated patch instruction. The documented privilege-escalation stage targets a finite build set, creating a practical way to rank users in defence, policy, trading, manufacturing and other targeted functions for immediate validation.
Direct detection engineering to implement the published filenames, path, scheduled task, domain and curl-to-%TEMP% execution pattern. A clean version dashboard cannot disprove execution that occurred before the stable browser update or before the Windows elevation-of-privilege fix was deployed.
Treat successful post-exploitation as an endpoint rebuild and identity investigation decision. GemStone’s cookie, storage, keystroke and session collection means containment must account for browser-held identity material and not stop at removing the extension or updating Chrome.
Evidence of closure
- Endpoint inventory proves Chromium-based browsers are current on all targeted Windows builds.
- Hunt results document disposition for every matched filename, task, path, domain or command.
- Reimaging records exist for every host with confirmed post-exploitation execution.
- The artefact package includes sender, subject, URL, redirect chain and recipient disposition.
The Security.io assessment
Confidence is high that the exploit chain was used because Proofpoint directly observed multiple campaigns and published detailed execution mechanics and artefacts. Attribution confidence varies by cluster, and the common source of BlueMoon remains unresolved. Shared code is evidence of common capability, not proof that one authority directed every campaign.
The exploitable population is narrower than the entire Chrome estate because the documented Windows elevation stage targets older builds. That constraint should improve prioritisation, not justify delay: Proofpoint observed current campaigns against selected organisations and the browser stages can still provide meaningful attacker capability before privilege escalation.
The management lesson is that upstream transparency and downstream release cadence now form part of exposure management. Security leaders should measure time from public fix visibility through stable deployment, not only time from a vendor bulletin to installation. Patch-gap risk is especially material for open-source components embedded across several downstream browsers.
Questions for the morning meeting
- Which users still combine vulnerable Chromium-based browsers with the documented Windows builds?
- Can endpoint telemetry detect the published curl-to-%TEMP% execution chain?
- Are email controls retaining redirects and compromised-sender evidence for targeted lures?
- Who owns reimaging when a malicious browser extension alters protected preferences?