[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBhqJTHhStt8vu8inxWrqzrMI7U0BFcSriTz3SYvfV04":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"8f16d4dc-11d9-49e9-ad68-93fe007bdd78","Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week","four-spy-groups-used-the-same-chrome-and-windows-exploit-kit-within-a-week-992750","Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,","Multiple espionage groups, primarily China-aligned, have been observed deploying a new exploit kit named BlueMoon. This kit chains together vulnerabilities in Google Chrome and Microsoft Windows, including patch-gap zero-days. The exploit chain begins with phishing, leading to code execution and privilege escalation, ultimately downloading further payloads.","Four spy groups used the same BlueMoon exploit kit for Chrome and Windows vulnerabilities.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Ffour-spy-groups-used-same-chrome-and.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhxouoVfK0MjZpruL0J1chmWnC7avUov1fOLbgX-XyFGrTcXeOh08tVntBjzJ7wBMmOB3P-PpxMr6E868Wpsaky-b-Nrf1LajzoQFfmjnkI1KHQzGXrCcVnC57nF2ndYZHCLx5WA3dENCWmCbZlSAb5TC-p8DXCGWxWB7I3iRIsdMMk6SS6IV03722lZIS4\u002Fs1600\u002Fspy.jpg","2026-09-09T16:34:05+00:00","2026-09-09T20:00:39.432559+00:00",9,[17,20,23,25,27,29],{"name":18,"type":19},"APT31","threat_actor",{"name":21,"type":22},"Google Chrome","product",{"name":24,"type":22},"Microsoft Windows",{"name":26,"type":22},"V8",{"name":28,"type":22},"Google Gemini",{"name":30,"type":31},"BlueMoon","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-85046","Type confusion in V8 in Google Chrome",{"type":57,"value":61,"context":62},"CVE-2026-85880","Heap-based buffer overflow vulnerability in Windows ALPC",[21,24,26],{"controls":65,"vendors":152},[66,94,123],{"slug":67,"name":68,"problem":69,"products":70},"patch-management","Automated patch management","Known holes get closed in days, not months.",[71,78,86],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":67,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":124,"name":125,"problem":126,"products":127},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",[153,159,161],{"slug":154,"name":155,"logo_path":156,"roles":157},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[158],"affected",{"slug":137,"name":138,"logo_path":139,"roles":160},[158],{"slug":145,"name":146,"logo_path":147,"roles":162},[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":179},"bluemoon-exploit-kit-chains-chrome-windows-zero-days-across-multiple-apt-groups","BlueMoon Exploit Kit Chains Chrome & Windows Zero-Days Across Multiple APT Groups","Multiple China-aligned espionage groups exploited the same chained vulnerabilities in Google Chrome and Microsoft Windows within a single week, leveraging a shared exploit kit called BlueMoon. The attack chain began with phishing emails and progressed through code execution to privilege escalation, highlighting how 'patch-gap' zero-days — vulnerabilities that exist between when a patch is released and when organizations apply it — can be rapidly weaponized and shared across threat actors. The fact that multiple distinct APT groups used the same kit simultaneously suggests a sophisticated shared tooling ecosystem, compressing the window organizations have to respond. This matters because even a brief delay in patching can expose critical systems to nation-state-level adversaries who actively monitor patch releases to reverse-engineer exploits.",[169,170,171,172,173,174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management","CIS Control 9: Email and Web Browser Protections","CIS Control 17: Incident Response Management","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management Planning","NIST SI-2: Flaw Remediation","NIST SI-3: Malicious Code Protection","NIST RA-5: Vulnerability Monitoring and Scanning","MITRE ATT&CK T1203: Exploitation for Client Execution","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1566: Phishing (Initial Access)",{}]