{"id":2009,"date":"2026-09-10T07:20:20","date_gmt":"2026-09-10T00:20:20","guid":{"rendered":"https:\/\/vncybers.vn\/ho-so-apt31-bo-cong-cu-exploit-bluemoon-bi-bon-nhom-gian-diep-dung-chung-trong-mot-tuan\/"},"modified":"2026-09-10T07:22:32","modified_gmt":"2026-09-10T00:22:32","slug":"apt31-profile-bluemoon-exploit-kit-four-spy-groups","status":"publish","type":"post","link":"https:\/\/vncybers.vn\/en\/ho-so-apt31-bo-cong-cu-exploit-bluemoon-bi-bon-nhom-gian-diep-dung-chung-trong-mot-tuan\/","title":{"rendered":"APT31 Files: BlueMoon Exploitation Toolkit Shared by Four Spy Groups for a Week"},"content":{"rendered":"

On September 9, 2026, security company Proofpoint published a report on a previously undocumented exploit kit called BlueMoon<\/strong>. What is alarming is that within less than a week of its first appearance, BlueMoon was used by at least four threat clusters linked to state-sponsored espionage \u2014 the majority suspected to have ties to China.<\/p>\n

APT31 \u2014 the first group to use BlueMoon<\/h2>\n

BlueMoon was first observed in the wild on August 28, 2026, deployed by the group APT31<\/strong> . APT31 is a threat group sponsored by the Chinese state, also tracked under various aliases including Bronze Vinewood<\/em>, Judgement Panda<\/em>, JungleBamboo<\/em>, PerplexedGoblin<\/em>, RedBravo<\/em>, TA412<\/em>, Tide Castle<\/em> and Violet Typhoon<\/em>. The group has a long history of espionage targeting non-governmental organizations (NGOs), mining companies, and commodity trading firms in the United States.<\/p>\n

In the August 2026 campaign, APT31 used spear-phishing emails to trick victims into clicking on a malicious link, triggering BlueMoon. Once browser control was achieved, the kit downloaded a loader that installed a Chrome extension disguised as Google Gemini \u2014 actually a backdoor named GemStone<\/strong> \u2014 allowing the threat actor to execute remote commands and steal login credentials.<\/p>\n

A three-vulnerability chain exploit<\/h2>\n

BlueMoon chains three vulnerabilities together to achieve full system control over the victim:<\/p>\n

    \n
  • CVE-2026-85046<\/strong>: A type confusion vulnerability in V8 \u2014 Google Chrome's JavaScript engine. Google patched this vulnerability the week before the report was published.<\/li>\n
  • V8 sandbox escape vulnerability<\/strong> (no CVE assigned): A second V8 vulnerability that allows escaping Chrome's sandbox, extending the attack surface beyond the browser.<\/li>\n
  • CVE-2026-85880<\/strong>: A heap-based buffer overflow vulnerability in Windows Advanced Local Procedure Call (ALPC), enabling local privilege escalation (LPE). Microsoft addressed this in the September 2026 Patch Tuesday update.<\/li>\n<\/ul>\n

    Notably, both V8 vulnerabilities were \"patch-gap zero-days\" \u2014 meaning patches had already appeared in the public Chromium source code but had not yet been pushed to the stable Chrome release. Proofpoint assessed that the BlueMoon developer may have been actively monitoring Chromium patch commits to reverse-engineer vulnerabilities and develop exploits before updates reached end users.<\/p>\n

    Chu\u1ed7i t\u1ea5n c\u00f4ng t\u1eebng b\u01b0\u1edbc<\/h2>\n

    The BlueMoon attack chain proceeds in the following stages:<\/p>\n

      \n
    1. The victim receives a spear-phishing email containing a malicious URL and clicks the link.<\/li>\n
    2. The landing page triggers two V8 vulnerabilities in sequence to achieve code execution and escape the browser sandbox.<\/li>\n
    3. A reflectively loaded DLL fingerprints the Windows host to decide whether to proceed with further exploitation.<\/li>\n
    4. A second DLL executes the LPE exploit (CVE-2026-85880) to elevate privileges on the renderer process.<\/li>\n
    5. Shellcode is injected into the parent Chrome broker process, executing a command to download the payload from the C2 server via curl<\/code>.<\/li>\n
    6. The final payload is deployed depending on the threat actor behind the campaign.<\/li>\n<\/ol>\n

      \"M\u1eabu<\/p>\n

      Four groups, four targets, one toolkit<\/h2>\n

      Within less than a week of its first appearance, BlueMoon was shared and deployed by at least three other groups:<\/p>\n

      UNK_LateNight<\/strong> (beginning September 2, 2026): A China-aligned cluster that targeted multiple U.S. aerospace companies. BlueMoon was used to deploy the ShadowPad<\/em> backdoor via DLL sideloading.<\/p>\n

      UNK_DoubleCheck<\/strong> (beginning September 2, 2026): This group is notable for targeting a manufacturing entity in Vi\u1ec7t Nam<\/strong>. Victims were directed to actor-controlled Cloudflare Workers domains, where BlueMoon deployed a Rust binary. The malware connected to a Cloudflare R2 Bucket to fetch and execute additional DLL sideloading payloads.<\/p>\n

      UNK_QuietRacket<\/strong> (beginning September 3, 2026): A China-aligned actor targeting government, consulting and financial sector organizations in Indonesia<\/strong> and Singapore<\/strong>. This cluster's BlueMoon variant used an in-memory .NET assembly and created a scheduled task for persistence via DLL sideloading.<\/p>\n

      Signs of AI-assisted development<\/h2>\n

      Proofpoint researchers found that BlueMoon's source code contained extensive verbose comments and detailed error logging \u2014 characteristics commonly associated with AI-assisted code generation. The source code also contained multiple references to Google's v8CTF<\/em> program \u2014 a capture-the-flag competition focused on V8 exploitation. Proofpoint was unable to determine whether the V8 exploits were genuinely developed through this bug bounty framework, or whether the references were a technique to bypass large language model (LLM) content filters.<\/p>\n

      Spreading risk and recommendations<\/h2>\n

      CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities (KEV) catalog on September 4, 2026, giving U.S. federal civilian agencies until September 18 to patch. However, updating Chrome only blocks the initial infection vector \u2014 it does not automatically remove malicious components that have already been installed.<\/p>\n

      Proofpoint recommends checking for the following indicators of compromise on systems:<\/p>\n

        \n
      • Process tree: chrome.exe<\/code> spawning cmd.exe<\/code>, then curl.exe<\/code>, then msgbox.exe<\/code>.<\/li>\n
      • File: ChromeUpdate.exe<\/code> or msgbox.exe<\/code> in the %TEMP%<\/code> Windows folder.<\/li>\n
      • Folder: C:\\Users\\Public\\stomp_ext<\/code>.<\/li>\n
      • Scheduled task name: EdgeCore_AutoUpdate<\/code>, MicrosoftEdgeUpdatesTaskMachine<\/code>, Avpcheckup<\/code> or GeForceService<\/code>.<\/li>\n
      • Mutex: Dataupcheckinfo<\/code>.<\/li>\n
      • Registry key: HKCU\\SOFTWARE\\Classes\\CLSID\\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\\InprocServer32<\/code>.<\/li>\n<\/ul>\n

        The rapid sharing and deployment of BlueMoon across multiple groups in a historically short time suggests that the barrier to developing high-end exploits is dropping significantly, partly driven by AI tools assisting in vulnerability analysis and exploit code authoring.<\/p>\n

        VNCyberS<\/strong> compiled from The Hacker News and Proofpoint<\/em><\/p>","protected":false},"excerpt":{"rendered":"

        Ng\u00e0y 9 th\u00e1ng 9 n\u0103m 2026, c\u00f4ng ty b\u1ea3o m\u1eadt Proofpoint c\u00f4ng b\u1ed1 b\u00e1o c\u00e1o v\u1ec1 m\u1ed9t b\u1ed9 c\u00f4ng c\u1ee5 khai th\u00e1c l\u1ed7 h\u1ed5ng (exploit kit) ch\u01b0a t\u1eebng \u0111\u01b0\u1ee3c ghi nh\u1eadn tr\u01b0\u1edbc \u0111\u00e2y, mang t\u00ean BlueMoon. \u0110i\u1ec1u \u0111\u00e1ng lo ng\u1ea1i l\u00e0 trong v\u00f2ng ch\u01b0a \u0111\u1ea7y m\u1ed9t tu\u1ea7n k\u1ec3 t\u1eeb khi xu\u1ea5t hi\u1ec7n l\u1ea7n \u0111\u1ea7u, BlueMoon […]<\/p>\n","protected":false},"author":2,"featured_media":2008,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[70],"tags":[200,786,787,789,790,788,201,302,792,791],"class_list":["post-2009","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ho-so","tag-apt-trung-quoc","tag-apt31","tag-bluemoon","tag-cve-2026-85046","tag-cve-2026-85880","tag-exploit-kit","tag-gian-diep-mang","tag-spear-phishing","tag-unk_doublecheck","tag-unk_latenight"],"_links":{"self":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/comments?post=2009"}],"version-history":[{"count":1,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2009\/revisions"}],"predecessor-version":[{"id":2010,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/posts\/2009\/revisions\/2010"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media\/2008"}],"wp:attachment":[{"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/media?parent=2009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/categories?post=2009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vncybers.vn\/en\/wp-json\/wp\/v2\/tags?post=2009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}