[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fd6ehf1a4xePZ5dt-Yy_1MHQoYp_gGxvvzs8yhKSvdj0":3},{"article":4,"iocs":53,"watch_terms":63,"solutions":64,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"c1d5a372-48c8-427b-9163-1d5d39363357","Chinese espionage groups swarm to exploit triple-link chain of zero-days","chinese-espionage-groups-swarm-to-exploit-triple-link-chain-of-zero-days-b9b5ad","Multiple China-aligned threat groups exploited the defects quickly to target various organizations. Proofpoint said the activity is ongoing and expects it to widen. The post Chinese espionage groups swarm to exploit triple-link chain of zero-days appeared first on CyberScoop.","Proofpoint has identified at least four China-aligned threat groups exploiting a chain of three zero-day vulnerabilities, dubbed BlueMoon, since late August. The exploit chain targets Chrome, Chromium-based browsers, and Windows, allowing attackers to gain system privileges. APT31, also known as Violet Typhoon, was the first to exploit these vulnerabilities, followed by other groups targeting various sectors including NGOs, mining, commodity trading, and aerospace in the US, Indonesia, and Singapore.","Chinese espionage groups exploit a chain of three zero-day vulnerabilities to target organizations.","https:\u002F\u002Fcyberscoop.com\u002Fchina-espionage-groups-exploit-chain-zero-days\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2026\u002F04\u002FGettyImages-1332529886.jpg","2026-09-09T21:17:32+00:00","2026-09-09T22:00:51.248253+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"TA412","threat_actor",{"name":21,"type":19},"Violet Typhoon",{"name":23,"type":19},"APT31",{"name":25,"type":19},"UNK_LateNight",{"name":27,"type":19},"UNK_DoubleCheck",{"name":29,"type":19},"UNK_QuietRacket","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60],{"type":55,"value":56,"context":57},"cve","CVE-2026-85046","Remote-code execution vulnerability in JavaScript engine for Chromium-based browsers.",{"type":55,"value":59,"context":57},"CVE-2026-87491",{"type":55,"value":61,"context":62},"CVE-2026-85880","Privilege-escalation zero-day vulnerability in Windows Advanced Local Procedure Call.",[],{"controls":65,"vendors":149},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"patch-management","Automated patch management","Known holes get closed in days, not months.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":67,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":124,"name":125,"problem":126,"products":127},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[128,136,141],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":137,"product_name":138,"url":139,"description":140},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",[150,156,158],{"slug":151,"name":152,"logo_path":153,"roles":154},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[155],"affected",{"slug":80,"name":81,"logo_path":82,"roles":157},[155],{"slug":129,"name":130,"logo_path":131,"roles":159},[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":178},"chinese-apt-groups-chain-three-zero-days-to-compromise-chrome-and-windows","Chinese APT Groups Chain Three Zero-Days to Compromise Chrome and Windows","At least four China-aligned espionage groups rapidly exploited a chain of three previously unknown (zero-day) vulnerabilities in Chrome-based browsers and Windows, enabling full system privilege escalation with no patch available at the time of attack. The speed at which multiple threat actors adopted this exploit chain — beginning with APT31 — suggests sophisticated intelligence-sharing or parallel discovery among state-sponsored groups. This incident highlights the extreme danger of zero-day chaining, where individually limited flaws are combined to produce catastrophic impact. Organizations relying solely on reactive patching are left dangerously exposed during the window between discovery and vendor remediation. Targeted sectors such as NGOs, aerospace, and commodity trading represent high-value intelligence targets, underscoring that any organization with sensitive data is a potential victim.",[166,167,168,169,170,171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 8: Audit Log Management","CIS Control 6: Access Control Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST IR-6: Incident Reporting","NIST SI-2: Flaw Remediation","NIST AC-6: Least Privilege","NIST RA-5: Vulnerability Monitoring and Scanning","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","ITIL: Change and Release Management (Emergency Change Procedures)",{}]