APT31 Files: BlueMoon Exploitation Toolkit Shared by Four Spy Groups for a Week

On September 9, 2026, security company Proofpoint published a report on a previously undocumented exploit kit called BlueMoon. What is alarming is that within less than a week of its first appearance, BlueMoon was used by at least four threat clusters linked to state-sponsored espionage — the majority suspected to have ties to China.

APT31 — the first group to use BlueMoon

BlueMoon was first observed in the wild on August 28, 2026, deployed by the group APT31 . APT31 is a threat group sponsored by the Chinese state, also tracked under various aliases including Bronze Vinewood, Judgement Panda, JungleBamboo, PerplexedGoblin, RedBravo, TA412, Tide Castle and Violet Typhoon. The group has a long history of espionage targeting non-governmental organizations (NGOs), mining companies, and commodity trading firms in the United States.

In the August 2026 campaign, APT31 used spear-phishing emails to trick victims into clicking on a malicious link, triggering BlueMoon. Once browser control was achieved, the kit downloaded a loader that installed a Chrome extension disguised as Google Gemini — actually a backdoor named GemStone — allowing the threat actor to execute remote commands and steal login credentials.

A three-vulnerability chain exploit

BlueMoon chains three vulnerabilities together to achieve full system control over the victim:

• CVE-2026-85046: A type confusion vulnerability in V8 — Google Chrome's JavaScript engine. Google patched this vulnerability the week before the report was published.
• V8 sandbox escape vulnerability (no CVE assigned): A second V8 vulnerability that allows escaping Chrome's sandbox, extending the attack surface beyond the browser.
• CVE-2026-85880: A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC), enabling local privilege escalation (LPE). Microsoft addressed this in the September 2026 Patch Tuesday update.

Notably, both V8 vulnerabilities were "patch-gap zero-days" — meaning patches had already appeared in the public Chromium source code but had not yet been pushed to the stable Chrome release. Proofpoint assessed that the BlueMoon developer may have been actively monitoring Chromium patch commits to reverse-engineer vulnerabilities and develop exploits before updates reached end users.

Chuỗi tấn công từng bước

The BlueMoon attack chain proceeds in the following stages:

1. The victim receives a spear-phishing email containing a malicious URL and clicks the link.
2. The landing page triggers two V8 vulnerabilities in sequence to achieve code execution and escape the browser sandbox.
3. A reflectively loaded DLL fingerprints the Windows host to decide whether to proceed with further exploitation.
4. A second DLL executes the LPE exploit (CVE-2026-85880) to elevate privileges on the renderer process.
5. Shellcode is injected into the parent Chrome broker process, executing a command to download the payload from the C2 server via curl.
6. The final payload is deployed depending on the threat actor behind the campaign.

Four groups, four targets, one toolkit

Within less than a week of its first appearance, BlueMoon was shared and deployed by at least three other groups:

UNK_LateNight (beginning September 2, 2026): A China-aligned cluster that targeted multiple U.S. aerospace companies. BlueMoon was used to deploy the ShadowPad backdoor via DLL sideloading.

UNK_DoubleCheck (beginning September 2, 2026): This group is notable for targeting a manufacturing entity in Việt Nam. Victims were directed to actor-controlled Cloudflare Workers domains, where BlueMoon deployed a Rust binary. The malware connected to a Cloudflare R2 Bucket to fetch and execute additional DLL sideloading payloads.

UNK_QuietRacket (beginning September 3, 2026): A China-aligned actor targeting government, consulting and financial sector organizations in Indonesia and Singapore. This cluster's BlueMoon variant used an in-memory .NET assembly and created a scheduled task for persistence via DLL sideloading.

Signs of AI-assisted development

Proofpoint researchers found that BlueMoon's source code contained extensive verbose comments and detailed error logging — characteristics commonly associated with AI-assisted code generation. The source code also contained multiple references to Google's v8CTF program — a capture-the-flag competition focused on V8 exploitation. Proofpoint was unable to determine whether the V8 exploits were genuinely developed through this bug bounty framework, or whether the references were a technique to bypass large language model (LLM) content filters.

Spreading risk and recommendations

CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalog on September 4, 2026, giving U.S. federal civilian agencies until September 18 to patch. However, updating Chrome only blocks the initial infection vector — it does not automatically remove malicious components that have already been installed.

Proofpoint recommends checking for the following indicators of compromise on systems:

• Process tree: chrome.exe spawning cmd.exe, then curl.exe, then msgbox.exe.
• File: ChromeUpdate.exe or msgbox.exe in the %TEMP% Windows folder.
• Folder: C:\Users\Public\stomp_ext.
• Scheduled task name: EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup or GeForceService.
• Mutex: Dataupcheckinfo.
• Registry key: HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32.

The rapid sharing and deployment of BlueMoon across multiple groups in a historically short time suggests that the barrier to developing high-end exploits is dropping significantly, partly driven by AI tools assisting in vulnerability analysis and exploit code authoring.

VNCyberS compiled from The Hacker News and Proofpoint