Threat Overview
Proofpoint and Volexity disclosed on September 9, 2026 that multiple espionage-focused threat clusters rapidly adopted a shared exploit kit called BlueMoon. The chain combines CVE-2026-85046, a Chrome V8 type-confusion flaw, CVE-2026-87491, a V8 sandbox escape, and CVE-2026-85880, a Windows ALPC local privilege-escalation flaw. Proofpoint observed BlueMoon use beginning August 28 by APT31/JungleBamboo, while Volexity observed a separate UTA0560 campaign on September 1. Other clusters used the same kit against U.S. aerospace/defense, Vietnamese manufacturing, and government, consulting, and financial-sector targets in Southeast Asia.
The chain begins from spear-phishing links, gains code execution and sandbox escape in Chrome, fingerprints the host, elevates the renderer process, injects into the Chrome broker, and executes an operator-specified command. Proofpoint reports the default command uses curl to download and execute a payload from the Windows temporary directory. This hunt is campaign-focused rather than a repeat of the individual Chrome and Windows vulnerability advisories already covered earlier in the month.
References
- Proofpoint Threat Research – Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days – published September 9, 2026
- Volexity – Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows – published September 9, 2026
- The Hacker News – Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week – published September 9, 2026
- BleepingComputer – New BlueMoon kit exploited Windows and Chrome zero-day flaws – published September 10, 2026
Impacted Systems
Products/platforms: Google Chrome/Chromium V8 on Windows plus Microsoft Windows. BlueMoon chains CVE-2026-85046, CVE-2026-87491, and CVE-2026-85880. Chrome CVE-2026-85046 was fixed in stable Chrome 152.0.7977.82/.83 for Windows/macOS and 152.0.7977.82 for Linux; CVE-2026-87491 was fixed in Chrome 153.0.8010.36/.37 for Windows/macOS and 153.0.8010.36 for Linux. Windows CVE-2026-85880 was fixed in Microsoft’s September 8, 2026 security release; affected Windows builds should be validated against the MSRC advisory. Attack prerequisite: a targeted user follows a spear-phishing link to actor-controlled web content while running vulnerable browser/OS components. Observed targets include NGOs, mining/commodity firms, U.S. aerospace and defense-industrial-base organizations, manufacturing, government, consulting, and financial-sector organizations.
Why this matters
BlueMoon demonstrates that a weaponized browser-to-SYSTEM chain that would normally be rare and expensive was shared across multiple distinct threat clusters within days. The campaign combines a common user interaction – opening a phishing link – with browser exploitation, privilege escalation, payload execution, persistence, and credential theft.
Exploitation Status
Confirmed active exploitation. Proofpoint and Volexity observed distinct campaigns using the chain beginning August 28 and September 1, 2026. The three vulnerabilities are now patched and have been added to CISA’s Known Exploited Vulnerabilities catalog. Proofpoint expects further proliferation. Campaign-specific payloads vary by actor, so the hunt emphasizes the shared exploit-chain outcomes plus publicly reported persistence artifacts.
What this hunt looks for
Devices still exposed to the three BlueMoon CVEs, Chrome spawning command shells or curl, reported TEMP payload names, the reported GemStone extension directory, reported scheduled-task persistence names, the reported registry persistence key, broader suspicious Chrome child processes, rare outbound destinations from Chrome/curl/reported payloads, and Windows Security Event process-creation fallbacks.
Required logs
- Defender Vulnerability Management for exposed-device identification.
- Defender for Endpoint / Defender XDR process, file, registry, and network telemetry.
- Windows SecurityEvent 4688 with command-line auditing as a process-creation fallback.
First Pass – Devices Exposed to the BlueMoon CVE Chain
DeviceTvmSoftwareVulnerabilities
| where CveId in~ ("CVE-2026-85046","CVE-2026-87491","CVE-2026-85880")
| project DeviceName, DeviceId, OSPlatform, OSVersion, OSArchitecture, CveId, VulnerabilitySeverityLevel, SoftwareVendor, SoftwareName, SoftwareVersion, RecommendedSecurityUpdate
| order by DeviceName ascBlueMoon-Reported Chrome to Command Shell and curl Chain
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","curl.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated descBlueMoon-Reported TEMP Payload Names
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FileName in~ ("ChromeUpdate.exe","msgbox.exe")
| where FolderPath has @"\Temp\" or FolderPath endswith @"\Temp"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA1, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descBlueMoon-Reported GemStone Extension Folder
DeviceFileEvents
| where TimeGenerated > ago(30d)
| where FolderPath has @"C:\Users\Public\stomp_ext"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA1, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descBlueMoon-Reported Scheduled Task Persistence Names
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "schtasks.exe"
| where ProcessCommandLine has_any ("EdgeCore_AutoUpdate","MicrosoftEdgeUpdatesTaskMachine","Avpcheckup","GeForceService")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated descBlueMoon-Reported Registry Persistence Key
DeviceRegistryEvents
| where TimeGenerated > ago(30d)
| where RegistryKey has @"HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32"
| project TimeGenerated, DeviceName, ActionType, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| order by TimeGenerated descChrome Spawning Post-Exploitation LOLBins
DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName =~ "chrome.exe"
| where FileName in~ ("cmd.exe","powershell.exe","pwsh.exe","curl.exe","certutil.exe","bitsadmin.exe","rundll32.exe","regsvr32.exe","mshta.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated descRare Outbound Destinations From Chrome, curl, or Observed Payloads
let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where InitiatingProcessFileName in~ ("chrome.exe","curl.exe","ChromeUpdate.exe","msgbox.exe")
| summarize by DeviceId, InitiatingProcessFileName, RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(2d)
| where InitiatingProcessFileName in~ ("chrome.exe","curl.exe","ChromeUpdate.exe","msgbox.exe")
| join kind=leftanti Baseline on DeviceId, InitiatingProcessFileName, RemoteUrl, RemoteIP
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
| order by TimeGenerated descWindows SecurityEvent Fallback for Chrome to Shell or curl
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 4688
| where ParentProcessName endswith @"\chrome.exe"
| where NewProcessName has_any (@"\cmd.exe",@"\powershell.exe",@"\pwsh.exe",@"\curl.exe",@"\certutil.exe",@"\bitsadmin.exe",@"\rundll32.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated descDetection Notes
The highest-signal campaign artifacts are the reported Chrome-to-cmd/curl process sequence, specific TEMP payload names, the C:\Users\Public\stomp_ext directory, named scheduled tasks, and the published registry key. Those artifacts are campaign observations and may not appear in every BlueMoon deployment because different clusters select different payloads. The vulnerable-device query identifies exposure, not compromise. Generic Chrome child-process queries can be noisy and require surrounding context. DeviceTvmSoftwareVulnerabilities, DeviceProcessEvents, DeviceFileEvents, DeviceRegistryEvents, and DeviceNetworkEvents require Defender XDR/MDE telemetry. The SecurityEvent fallback requires Event ID 4688 with process-command-line auditing. Patching prevents the known exploit chain but does not remove persistence or payloads already installed.
Killian Sherer 