Four separate state-linked hacking groups started using the exact same Chrome and Windows exploit chain within a ten-day window in late August and early September, according to new research from Proofpoint. They were not collaborating. They were not sharing infrastructure or targets. They were, somehow, running identical code.
That is the detail that matters more than any single CVE in Proofpoint’s report on an exploit kit it calls BlueMoon. This publication reported in August that frontier AI labs were racing to automate vulnerability discovery for defenders. BlueMoon is early, concrete evidence of what the same acceleration looks like on the attacker’s side: a shrinking window between a public patch and a working exploit, and a growing pool of threat actors who can exploit it.
What happened
Proofpoint says the China-aligned espionage group it tracks as TA412 (also known as APT31 or Violet Typhoon) was first to use BlueMoon, on August 28, targeting U.S. NGOs, mining companies and commodity traders with a fake browser extension disguised as Google’s Gemini assistant. Within days, three more clusters adopted the same kit. UNK_LateNight targeted U.S. aerospace and defense companies with fake procurement inquiries, ultimately deploying the ShadowPad backdoor associated with Chinese state actors. UNK_DoubleCheck used a compromised Southeast Asian government email account to target a Vietnamese manufacturer. UNK_QuietRacket went after government, consulting and financial targets in Indonesia and Singapore using fake conference invitations. Proofpoint has not attributed the latter two clusters to a specific country, though it assesses the activity as likely espionage-motivated.
Media Partner
The mechanism, at the level defenders need
BlueMoon chains a Chrome/Chromium browser flaw with a Windows privilege-escalation flaw to move from running code inside the browser sandbox to full control of the host. Proofpoint is withholding the operational exploitation detail, and so are we; what matters for security teams is the timing. The Chromium fix for the browser-side vulnerability was committed to the public source tree on August 7 but did not reach the general stable release of Chrome until September 3. That nearly four-week gap between a visible patch and a shipped fix is what researchers call the patch gap, and it is exactly the window BlueMoon’s operators used.
Patch gaps are not new. What is new, according to Proofpoint, is how fast this one went from a public code diff to a working, shared exploit kit deployed by four distinct actors. Historically, reverse-engineering a patch to build a reliable browser exploit within days has been rare enough that defenders treated the gap as a manageable risk. It is the same dynamic that put a separately disclosed, actively exploited Chrome V8 flaw under active attack earlier this month, underscoring how narrow the browser vendor’s margin for error has become.
The AI-development question
Proofpoint says it cannot conclusively prove BlueMoon was built with AI assistance, but it found several indicators consistent with it: unusually verbose debugging comments documenting iterative fixes, a referenced markdown file described as a session “handover document” of the kind AI coding agents use to pass context between sessions, and code artifacts referencing Google’s own v8CTF bug-bounty framework for the V8 engine. The final payload delivery step was also notably unsophisticated for a nation-state tool: by default, a successful exploit simply ran a visible curl command to download and execute a file, an approach that gives endpoint security products multiple chances to catch it.
Put those two facts together and a picture emerges of a capability that was built and shared quickly, ahead of an anticipated patch, with operational security treated as secondary to speed. Proofpoint’s own framing: the falling cost of turning a public patch into a weapon, as AI tooling increasingly assists that process, may be what is letting a single kit spread across four independent operators within days rather than months.
Not the first time, but faster
Proofpoint notes that rapid, near-simultaneous adoption of a single exploit across multiple China-aligned groups is a recurring pattern, not a first. It cites comparable episodes involving Microsoft Exchange and SharePoint vulnerabilities. What distinguishes BlueMoon is the compressed timeline: TA412 began on August 28, and three more clusters followed within the space of a week, all chaining the same three vulnerabilities, tracked as CVE-2026-85046 and CVE-2026-87491 in Chromium’s V8 engine and CVE-2026-85880 in the Windows kernel. Proofpoint credits collaboration with Google’s Threat Intelligence Group, Microsoft’s Threat Intelligence Center and Volexity for helping piece together the full picture, and it says it followed responsible disclosure practices with the affected vendors before publishing. How four separate operators obtained the same kit in that window remains unknown; Proofpoint’s working theories include a shared commercial supplier or a more centralized state distribution channel, and it expects BlueMoon to keep spreading to financially motivated actors as unpatched browsers dwindle.
What it means for the security leader
The traditional patch-gap calculus assumed defenders had weeks between a public fix landing upstream and a credible exploit appearing in the wild. That assumption no longer holds for widely used open-source components like Chromium, where the fix itself is public the moment it is committed. Security teams that track “patched in source, not yet in stable release” as a low-priority status should reconsider: for browsers and other software built on public repositories, that state is functionally equivalent to disclosure.
It also means detection needs to carry more of the load that patching used to carry alone. Proofpoint published a distinctive process-tree signature for BlueMoon activity (a browser process spawning a command shell that spawns curl, which spawns an unexpected executable) along with scheduled-task names and a YARA rule, precisely because the kit’s final stage is loud enough to catch if anyone is watching for it. That is a rare gift from an otherwise capable exploit chain, and it will not last if BlueMoon proliferates and its operators clean up their tradecraft, which Proofpoint expects to happen.
What to do
Patch Chrome, Chromium-based browsers and Windows on the fastest cycle your environment can support; Google itself responded to this dynamic by moving Chrome to a two-week stable release cadence. Hunt for the process-tree and scheduled-task indicators Proofpoint published rather than waiting on signature updates alone. And treat “fix merged upstream” as the start of your exposure window, not the end of it, for any software your organization runs that is built from a public repository.
Source: Proofpoint Threat Insight
