Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week
Four spy groups used the same Chrome and Windows exploit kit within a week, with APT31 being the first in-the-wild use attributed to China-aligned actors.
Intelligence analysis by Qwen 2.5 (3B)
Multiple espionage groups have started using a new exploit kit called BlueMoon, which combines vulnerabilities in Chrome and Windows. APT31 was the first to use it in the wild.
Some bad guys used a new trick to trick people into giving them their computer's password. They did it with a special program that uses two different bugs to do it. The first group to do it was from China, and they tricked people who work with money and things.
Analysis
{"
BlueMoon Exploit Kit Overview":"BlueMoon is a new exploit kit that combines vulnerabilities in Google Chrome and Microsoft Windows. It has been used by multiple espionage groups within a week.","
APT31's Use of BlueMoon":"APT31, a China-aligned state-sponsored group, was the first to use BlueMoon in the wild on August 28, 2026. They targeted NGOs, mining companies, and commodity trading firms in the U.S. with spear-phishing lures.","
UNK_LateNight's Use of BlueMoon":"UNK_LateNight, another China-aligned group, used BlueMoon to target U.S. aerospace companies. They deployed the ShadowPad backdoor using DLL sideloading.","
UNK_DoubleCheck's Use of BlueMoon":"UNK_DoubleCheck used BlueMoon to target a Vietnamese manufacturing entity. They used a Cloudflare Workers domain to download and execute a second DLL sideloading pair.","
UNK_QuietRacket's Use of BlueMoon":"UNK_QuietRacket used BlueMoon to target government, consulting, and financial sector organizations in Indonesia and Singapore. They modified the exploit kit to download and execute a DLL sideloading pair."}
Key points
- Multiple espionage groups used BlueMoon within a week
- APT31 was the first to use BlueMoon in the wild
- BlueMoon combines vulnerabilities in Chrome and Windows
- The exploit kit uses phishing emails to trick people
- The bad guys use different methods to hide their actions
Timely updates and security patches can help stop these bad guys from using their trick.
The bad guys might find new tricks to use, so we need to keep learning about computer security.
