Four hacker groups jointly exploited the Chrome and Windows vulnerabilities to launch attacks

Proofpoint disclosed a concerning cyber threat incident. A vulnerability exploitation toolkit named BlueMoon has been used for attacks by at least four hacker organizations. The core idea of this tool is to combine three vulnerabilities into a complete attack chain. Two vulnerabilities come from the V8 JavaScript engine of the Chrome browser, and another vulnerability exists in the old version of the Windows system kernel. When combined, the attacker only needs to construct a specially designed web page to remotely run code on the target device, obtain the highest system privileges, and install any malicious software.

The targets of this attack are widely distributed, covering institutions in different countries and industries. The four attackers each targeted different objects. The most famous is TA412. In 2024, the US authorities filed a lawsuit against it. For a long time this organization has been closely monitoring US NGOs, mining and commodity trading companies. The second organization, UNK_LateNight, focuses on attacking aerospace-related enterprises in the United States. UNK_DoubleCheck targets the manufacturing industry in Vietnam. The attack activities of UNK_QuietRacket are concentrated in Singapore and Indonesia.

The entire attack process is divided into two steps. The first step exploits two vulnerabilities in the V8 engine. The first one is a type confusion vulnerability, CVE-2026-85046. Attackers can meticulously construct JavaScript code to disrupt the browser's memory logic and achieve sandbox escape. Google has not assigned a CVE number to the second V8 sandbox escape vulnerability. The browser sandbox was originally a security isolation wall. Even if the web page code is controlled by malicious code, it can only run within the sandbox. After the escape of the sandbox, the malicious code will escape the restrictions of the browser.

The second step is to utilize the Windows kernel vulnerability CVE-2026-85880 for privilege escalation. The affected systems are Windows 10 version 1809, Windows Server 2019, Windows 10 version 2004, Server 2022 and the first version of Windows 11. After the vulnerability is triggered successfully, the malicious program can obtain the highest system-level privileges and is not constrained by the normal user privileges.

This attack combination has a key feature. It belongs to a vulnerability during the patch window period. The upstream code repository of the Chromium project has submitted the vulnerability repair code. However, after the code is submitted, Chrome and Edge, which are based on Chromium, still need some time to complete version packaging, testing, and then be pushed to ordinary users. During this time window, the public source code already contains the repair solution. Hackers can reverse-engineer the patch and quickly write a vulnerability exploitation program.

In the past, being able to stably exploit the complete vulnerability chain of the Chrome browser was a scarce resource with high value. After hackers obtained it, they usually used it cautiously, minimizing the exposure probability and prolonging the survival time of the attack tool. However, the performance of BlueMoon was completely different. The tool development speed was very fast, and it circulated among multiple threat groups within a short period of time. The attack behavior left obvious detection features.

Two factors have lowered the development threshold of vulnerability exploitation tools. The first factor is the open-source mechanism of the Chromium upstream source code mentioned earlier. Hackers do not need to mine the vulnerability from scratch, they only need to reverse-engineer the patch and can quickly write the exploitation code. The second factor is the popularization of AI tools. The work that previously required multiple professional vulnerability researchers to spend weeks or even months to complete is now largely shortened in time. The cost of vulnerability tool development has decreased, making it easier to share and circulate among multiple hacker groups.

These three related vulnerabilities have been patched within the last 24 hours. Browser manufacturers and Microsoft have released fix versions to block the vulnerabilities. However, Proofpoint reminds that vulnerability patching does not mean the threat disappears immediately. The BlueMoon toolkit is easy to deploy and has a low entry threshold. Before all browsers based on Chromium complete the version update, this toolkit will continue to spread. Some black market criminal groups with profit motives may also obtain this toolkit and use it for ransomware, data theft and other activities.