BlueMoon Exploit Kit Targets Chrome Zero-Days and Windows ALPC Vulnerability

A newly identified multi-stage exploit kit dubbed BlueMoon is actively targeting enterprise networks by stitching together Google Chrome zero-day vulnerabilities with a Microsoft Windows kernel local privilege escalation exploit. Reports published by threat intelligence firms Proofpoint and Volexity reveal that at least four cyber-espionage threat actors—primarily aligned with Chinese state interests—have deployed BlueMoon in spearphishing and watering-hole operations targeting critical sectors, non-governmental organizations (NGOs), and defense contractors.

By taking advantage of the vulnerability disclosure window between open-source Chromium code updates and official binary patches deployed to end-user systems, the developers behind the BlueMoon exploit kit reverse-engineered public bug fixes to build a highly reliable exploitation chain capable of executing arbitrary commands directly on target machines.

Exploit Architecture: From V8 Engine to Kernel Privileges

The BlueMoon exploit chain leverages a three-part vulnerability sequence designed to achieve remote code execution (RCE), break browser isolation boundaries, and escalate local privileges to gain full administrative control:

1. V8 Type Confusion (CVE-2026-85046): The initial entry point exploits a type-confusion flaw within Chrome’s V8 JavaScript engine. Type confusion occurs when the memory safety mechanisms of the V8 engine fail to enforce proper data types, allowing an attacker to manipulate object pointers and gain arbitrary memory read/write access inside the V8 sandbox.
2. V8 Sandbox Escape (CVE-2026-87491): To bypass Chromium’s internal memory safety boundary, the exploit corrupts WebAssembly metadata. This allows the attacker to execute embedded shellcode outside the restricted V8 sandbox boundary while remaining inside the browser’s renderer process.
3. Windows ALPC Kernel LPE (CVE-2026-85880): To escape the operating system’s browser sandbox entirely, BlueMoon weaponizes a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem. ALPC is a high-speed inter-process communication mechanism managed by the Windows kernel. Exploiting this memory corruption issue allows an unprivileged browser process to escalate privileges directly to kernel-level access.

The exploit operates within a Web Worker thread, attempting the exploitation chain up to five times to ensure reliability. After performing initial system fingerprinting, BlueMoon uses the Windows privilege escalation exploit to elevate the permissions of the Chrome renderer process. It then injects malicious code into Chrome’s parent process, executing operator-specified commands. By default, the exploit invokes curl.exe to drop a secondary binary payload into the target user’s %TEMP% directory and execute it immediately.

Proofpoint’s analysis indicates that the ALPC LPE exploit contains compilation timestamps dating back to 2025 and specifically targets legacy Windows builds. This suggests the kit’s developers repackaged an existing zero-day capability into the modular BlueMoon framework rather than engineering the kernel exploit from scratch.

Threat Actors and Campaign Tactics

Proofpoint and Volexity observed BlueMoon activity dating back to late August, identifying four distinct activity clusters leveraging the kit:

• JungleBamboo (APT31 / Violet Typhoon / Tide Castle): Observed deploying BlueMoon on August 28 during targeted spearphishing campaigns. JungleBamboo historically focuses on high-value individuals, mining companies, and NGOs. In these operations, the group deployed the Longtale/GemStone credential stealer, disguised as a legitimate Google Gemini extension.
• UTA0560: Detected on September 1 targeting users across multiple NGOs using donation-themed phishing lures. The infection chain dropped Grimwedge, an in-memory JScript backdoor capable of system reconnaissance, file and process management, remote command execution, and secondary payload deployment.
• UNK_LateNight: Deployed BlueMoon to deliver the ShadowPad modular remote access trojan (RAT) against U.S. aerospace and defense-industrial-base (DIB) organizations. ShadowPad is a known state-backed espionage backdoor used to maintain persistent access and exfiltrate sensitive IP.
• UNK_DoubleCheck: Targeted Vietnamese manufacturing firms using an in-memory Rust loader, though security researchers were unable to retrieve the final stage payload during analysis.

Risk Evaluation and Blast Radius

The blast radius of the BlueMoon exploit kit is particularly severe because it targets standard end-user interaction—such as clicking a link or visiting a compromised web page—to achieve full system takeover. Because the initial exploit stages execute silently within Chrome’s V8 engine and leverage Web Workers, end users receive no visual indicators or browser crash prompts during the compromise attempt.

Organizations across the defense industrial base, manufacturing, energy, mining, and civil society sectors face significant risk. Furthermore, security researchers warn that because modular exploit kits like BlueMoon demonstrate high reliability and reuse existing zero-day components, access brokers and financially motivated ransomware groups are likely to adopt similar exploit packages as patch details diffuse across the ecosystem.

Defensive Actions and Remediation

Defenders must take immediate steps to address both browser-level and system-level components of the exploit chain:

• Apply Vendor Updates: Update Google Chrome and all Chromium-based browsers to the latest stable release containing patches for CVE-2026-85046 and CVE-2026-87491. Ensure Microsoft Windows patches addressing the ALPC heap overflow (CVE-2026-85880) are applied across all desktop and server endpoints.
• Process Lineage Monitoring: Monitor endpoint detection and response (EDR) telemetry for abnormal process spawning. Specifically, alert on chrome.exe or other browser parent processes spawning command interpreter tools like cmd.exe, powershell.exe, or curl.exe that write executable binaries to the %TEMP% directory structure.
• Ingest Threat Indicators: Review and ingest the file hashes, malicious domain infrastructure, and IP indicators published in the Proofpoint and Volexity threat advisories to block known BlueMoon staging servers and payload delivery URLs at the perimeter.