Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Multiple China-aligned espionage groups exploited the same chained vulnerabilities in Google Chrome and Microsoft Windows within a single week, leveraging a shared exploit kit called BlueMoon. The attack chain began with phishing emails and progressed through code execution to privilege escalation, highlighting how 'patch-gap' zero-days — vulnerabilities that exist between when a patch is released and when organizations apply it — can be rapidly weaponized and shared across threat actors. The fact that multiple distinct APT groups used the same kit simultaneously suggests a sophisticated shared tooling ecosystem, compressing the window organizations have to respond. This matters because even a brief delay in patching can expose critical systems to nation-state-level adversaries who actively monitor patch releases to reverse-engineer exploits.