[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fycpTbLfqPHVhVwU5xSYg-KquiR27MnkwrJgufopBVTQ":3},{"article":4,"iocs":57,"watch_terms":67,"solutions":68,"lesson":172},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"0994a83f-fd18-40b2-a058-b5cb701e2838","BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days","bluemoon-exploit-kit-chains-recent-chrome-windows-zero-days-5fcbcf","Multiple espionage-motivated threat actors have adopted BlueMoon in opportunistic, rushed deployments. The post BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days appeared first on SecurityWeek.","A new exploit kit named BlueMoon is being rapidly adopted by multiple espionage-motivated threat actors, including China-linked groups like Violet Typhoon. The kit chains together two unpatched Chrome zero-days and one Windows zero-day, enabling sandbox escape and privilege escalation. Its ease of adoption suggests a potential proliferation and use by both espionage and financially motivated actors, possibly with AI assistance in its development.","BlueMoon exploit kit chains Chrome and Windows zero-days, adopted by multiple espionage groups.","https:\u002F\u002Fwww.securityweek.com\u002Fbluemoon-exploit-kit-chains-recent-chrome-windows-zero-days\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F03\u002Fexploit.jpeg","2026-09-12T11:10:00+00:00","2026-09-12T12:00:23.234024+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"Violet Typhoon","threat_actor",{"name":21,"type":19},"APT31",{"name":23,"type":19},"JungleBamboo",{"name":25,"type":19},"TA412",{"name":27,"type":19},"Tide Castle",{"name":29,"type":30},"Chrome","product","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":53},{"id":54,"icon":33,"name":55,"slug":56},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",[58,62,64],{"type":59,"value":60,"context":61},"cve","CVE-2026-85046","Chrome zero-day impacting V8 JavaScript and WebAssembly engine.",{"type":59,"value":63,"context":61},"CVE-2026-87491",{"type":59,"value":65,"context":66},"CVE-2026-85880","Windows zero-day, privilege escalation in ALPC.",[29],{"controls":69,"vendors":157},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":100,"name":101,"problem":102,"products":103},"patch-management","Automated patch management","Known holes get closed in days, not months.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":129,"name":130,"problem":131,"products":132},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":150,"vendor_name":151,"vendor_logo":152,"product_slug":153,"product_name":154,"url":155,"description":156},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",[158,164,166],{"slug":159,"name":160,"logo_path":161,"roles":162},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[163],"affected",{"slug":121,"name":122,"logo_path":123,"roles":165},[163],{"slug":167,"name":168,"logo_path":169,"roles":170},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png",[171],"reported_by",{"slug":173,"title":174,"body":175,"framework_refs":176,"framework_notes":190},"bluemoon-exploit-kit-chains-chrome-windows-zero-days-for-espionage","BlueMoon Exploit Kit Chains Chrome & Windows Zero-Days for Espionage","The BlueMoon exploit kit weaponizes three unpatched zero-day vulnerabilities — two in Chrome and one in Windows — chaining them together to achieve sandbox escape and full privilege escalation without requiring any user patches to have been missed, because these were zero-days at time of exploitation. The rapid adoption by multiple nation-state and potentially financially motivated threat actors underscores how commoditized exploit kits dramatically lower the skill barrier for sophisticated attacks. The suspected use of AI in the kit's development signals a dangerous acceleration in the pace at which zero-days can be packaged and distributed. Organizations that lack rapid response protocols and browser\u002FOS update hygiene are disproportionately exposed when zero-days of this severity emerge.",[177,178,179,180,181,182,183,184,185,186,187,188,189],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 10 – Malware Defenses","NIST SP 800-40 Rev. 4 – Guide to Enterprise Patch Management","NIST SP 800-61 Rev. 2 – Computer Security Incident Handling Guide","NIST SI-2 – Flaw Remediation","NIST SI-3 – Malicious Code Protection","NIST AC-6 – Least Privilege","MITRE ATT&CK T1203 – Exploitation for Client Execution","MITRE ATT&CK T1068 – Exploitation for Privilege Escalation","MITRE ATT&CK T1189 – Drive-by Compromise","ITIL – Problem Management (zero-day root cause tracking)","ITIL – Change Management (emergency patch procedures)",{}]