BlueMoon: four state-aligned actors chain two patch-gap Chrome zero-days and a Windows LPE within 12 days

Executive Summary

In late August and September 2026, Proofpoint documented BlueMoon, a novel exploit chain that four espionage-motivated, state-aligned threat clusters adopted within days of one another to compromise fully updated Windows machines through the browser.¹² The chain links three vulnerabilities: CVE-2026-85046, a type-confusion remote-code-execution bug in Chrome's V8 engine; CVE-2026-87491, a V8 out-of-bounds write used to escape the renderer sandbox; and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC for local privilege escalation.¹³⁴ Together they take an attacker from a crafted web page to SYSTEM-level control on a patched machine.¹

The defining detail is when the browser bugs were exploitable. Both V8 vulnerabilities were "patch-gap" zero-days: the fixes had already been committed to the public, upstream Chromium source code but had not yet rolled into the stable Chrome builds that users run. The fix for CVE-2026-85046 was committed upstream on August 7, 2026 but did not reach a general stable Chromium build until September 3 — a roughly four-week window in which anyone could reverse-engineer the public patch and exploit the still-unpatched stable browser.¹ This is the open-source-security paradox in operation: the transparency that lets defenders review a fix also hands attackers a map to the vulnerability before most users receive it.

The first cluster to use BlueMoon was TA412 (also tracked as APT31 / Violet Typhoon), a China-aligned actor, first observed on August 28, 2026.¹ Three further espionage clusters — UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket — began using the same chain between September 2 and 3.¹ TA412's own campaign is instructive: it spearphished US NGOs, mining firms and commodity traders while posing as university students seeking internships and as organizers reaching out about the Association for Asian Studies "AAS-in-Asia 2026" conference; victims who clicked were taken to actor-controlled pages that ran the exploit behind a loading screen before redirecting to legitimate sites like GitHub and asianstudies.org.¹ The post-exploitation payload is pointed: a malicious Chrome extension named GemStone, disguised as "Google Gemini," an AI browsing companion — a full browser-surveillance backdoor with keylogging, screen recording, cookie and credential theft, tab surveillance and remote command execution, installed by forging Chromium's Secure Preferences HMAC to bypass Web Store verification.¹ The other clusters carried different payloads: ShadowPad (UNK_LateNight), a Rust-based loader with Cloudflare R2 command-and-control (UNK_DoubleCheck), and shellcode with ChaCha20-encrypted DNS-over-HTTPS C&C (UNK_QuietRacket).¹

That four espionage actors picked up the same non-trivial exploit chain within about twelve days points less to four independent discoveries than to a shared source — a quartermaster or vendor distributing the kit — which is the strategically significant part: capability that would once have belonged to one well-resourced group is now being fielded across several at once, against NGOs, aerospace and defense, mining, and government and financial targets across the US and Asia.¹²

Verification of Claims

1. Claim: A three-CVE exploit chain (BlueMoon) took attackers from a web page to Windows privilege escalation, using two patch-gap Chrome zero-days. → Verified → Proofpoint documents the chain (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880); NVD confirms the CVEs as a V8 type confusion RCE, a V8 out-of-bounds write, and a Windows ALPC heap overflow LPE. The CVE-2026-85046 fix was committed upstream on August 7 but did not reach stable Chromium until September 3.¹³⁴

2. Claim: Four Chinese state-sponsored groups used BlueMoon. → Assessed / partly imprecise → TA412 is a well-established China-aligned actor (APT31 / Violet Typhoon). The other three are espionage-motivated clusters Proofpoint tracks under UNK_ designations; UNK_DoubleCheck's attribution is explicitly unclear. The near-simultaneous adoption points to a shared supplier rather than four independently developed capabilities.¹

3. Claim: BlueMoon was developed with AI assistance. → Weak evidence → Proofpoint notes development artifacts left in the samples — verbose logging and comments, evidence of iterative debugging, references to markdown handover documentation and the v8CTF bug-bounty framework — but states that "no single artifact conclusively confirms" AI involvement. It is a plausible, hedged observation, not an established fact.¹

4. Claim: The GemStone extension installs without Chrome Web Store verification. → Verified → Proofpoint states the extension bypassed Chromium's Secure Preferences HMAC protection using publicly documented forgery techniques to install without Web Store verification.¹

Timeline

Attack Anatomy

Initial access — targeted spearphishing links

TA412 approached victims with tailored lures — posing as students seeking internships and as organizers of the AAS-in-Asia 2026 conference — containing links to actor-controlled infrastructure (T1566.002).¹

Browser exploitation — patch-gap V8 zero-days

The link led to a page that, behind a loading screen, ran the exploit before redirecting to a legitimate site. CVE-2026-85046 (V8 type confusion) achieved remote code execution inside the Chrome sandbox; CVE-2026-87491 (V8 out-of-bounds write) escaped the renderer sandbox by overwriting WebAssembly compiled function bodies with shellcode (T1203).¹³

Privilege escalation — Windows ALPC

CVE-2026-85880, a heap overflow in Windows ALPC, elevated privileges locally, completing the path from web page to system compromise on a range of Windows 10, 11 and Server builds (T1068).¹⁴

Post-exploitation — a "Google Gemini" surveillance extension and other payloads

TA412 installed GemStone, a malicious Chrome extension masquerading as "Google Gemini," forging Chromium's Secure Preferences HMAC to install it without Web Store verification (T1176.001).¹ GemStone keylogs, records the screen, steals cookies and credentials, watches tabs, and executes remote commands via a Cloudflare Worker C&C (T1056.001, T1113, T1539, T1102).¹ Other clusters delivered ShadowPad via DLL side-loading (UNK_LateNight), a Rust loader with Cloudflare R2 C&C (UNK_DoubleCheck), and shellcode with ChaCha20-encrypted DNS-over-HTTPS C&C (UNK_QuietRacket) (T1574.001, T1071.004).¹

Threat Actor Profile

• TA412 — also tracked as APT31 and Violet Typhoon; a long-running China-aligned espionage actor. First to field BlueMoon (Aug 28, 2026), targeting US NGOs, mining and commodity trading with the GemStone extension.¹
• UNK_LateNight — espionage cluster; adopted BlueMoon Sep 2; delivered ShadowPad via DLL side-loading against US aerospace and defense.¹
• UNK_QuietRacket — espionage cluster; adopted Sep 3; targeted government, consulting and financial sectors in Indonesia and Singapore with ChaCha20-encrypted DoH C&C.¹
• UNK_DoubleCheck — suspected espionage cluster (attribution unclear); adopted Sep 2; a Rust loader with Cloudflare R2 C&C against Vietnamese manufacturing.¹
• Attribution confidence: High for TA412 (established APT31); the UNK_ clusters are espionage-motivated with varying confidence, and UNK_DoubleCheck's attribution is explicitly unclear. The rapid, shared adoption of a single non-trivial chain across four actors points to a common supplier/quartermaster rather than parallel independent development.¹
• Notable: Proofpoint observed development artifacts (verbose logging, iterative-debugging traces, markdown handover docs, v8CTF references) consistent with — but not conclusive of — AI-assisted development, and noted the default configuration's noisy curl-based downloads suggest the operators prioritized speed of deployment over stealth.¹

MITRE ATT&CK techniques (verified on attack.mitre.org):

Technical Indicators

exploit_chain:
  - "CVE-2026-85046 — V8 type confusion RCE (Chrome < 152.0.7977.82); upstream fix 7 Aug, stable 3 Sep 2026 (patch-gap)"
  - "CVE-2026-87491 — V8 out-of-bounds write, sandbox escape (Chrome < 153.0.8010.36)"
  - "CVE-2026-85880 — Windows ALPC heap overflow, local privilege escalation"
affected_windows:
  - "Windows 10 1809/2004/20H2/21H1/21H2/22H2; Server 2019/2022; Windows 11 21H2"
ta412_payload:
  - "GemStone — malicious Chrome extension disguised as 'Google Gemini'"
  - "capabilities: keylogging, screen recording, cookie/credential theft, tab surveillance, remote command execution"
  - "permissions: cookies, storage, tabs, scripting, activeTab, downloads, webNavigation, alarms"
  - "install: forges Chromium Secure Preferences HMAC to bypass Web Store verification"
  - "C&C: Cloudflare Worker"
other_payloads:
  - "UNK_LateNight: ShadowPad via DLL side-loading, registry persistence"
  - "UNK_DoubleCheck: Rust loader, RC4 decryption, Cloudflare R2 C&C"
  - "UNK_QuietRacket: injection shellcode, ChaCha20-encrypted DNS-over-HTTPS C&C"
host_indicators:
  - "process tree: chrome.exe -> cmd.exe -> curl.exe -> msgbox.exe"
  - "session storage key: v8ctf_exp_attempt"
  - "scheduled tasks: EdgeCore_AutoUpdate, GeForceService"
note: >
  Full IOC and detection detail is in Proofpoint's report. Redirect
  destinations shown to victims post-exploit included legitimate sites
  (GitHub, asianstudies.org) and are not themselves malicious.

Legal and Regulatory Response

No law-enforcement action or government advisory specific to BlueMoon had been published as of this writing; the disclosure is vendor threat research by Proofpoint.¹ The most important remediation is patching: Chrome/Chromium users needed the stable builds that closed CVE-2026-85046 (152.0.7977.82) and CVE-2026-87491 (153.0.8010.36), and Windows systems needed the fix for the ALPC LPE (CVE-2026-85880).³⁴ Because two of the three were patch-gap zero-days, the exposure window predates the public CVE dates for users on stable channels.¹

Impact Assessment

• Confirmed (per Proofpoint): Four espionage clusters used the BlueMoon chain between Aug 28 and Sep 3, 2026, achieving browser-to-system compromise on patched Windows machines via two patch-gap V8 zero-days and a Windows ALPC LPE.¹
• Confirmed: TA412 deployed the GemStone "Google Gemini" surveillance extension against US NGOs, mining and commodity firms; other clusters used ShadowPad, a Rust loader, and shellcode against US aerospace/defense and Asian government, financial, consulting and manufacturing targets.¹
• Assessed: A shared supplier/quartermaster is the likely explanation for the near-simultaneous adoption; UNK_DoubleCheck's attribution is unclear; AI-assisted development is suggested but not confirmed.¹
• Unknown: The total number of victims actually compromised (as distinct from targeted); the identity of the kit's supplier, if one exists; and the full set of actors beyond the four Proofpoint names.¹

Lessons and Defensive Recommendations

For SOC and endpoint teams:

• Patch-gap zero-days mean "up to date on the stable channel" is not the same as "not vulnerable" during the window between an upstream commit and a stable rollout. Track high-severity V8/Chromium upstream commits, prioritise Chrome/Chromium updates the moment stable ships, and consider tighter update SLAs for high-risk users (executives, NGO staff, engineers) who are the targets here.
• Hunt for the behavioural chain, not just the CVEs: a chrome.exe → cmd.exe → curl.exe process tree, scheduled tasks named to mimic updaters (EdgeCore_AutoUpdate, GeForceService), and unexpected Chrome extensions with broad permissions (cookies, tabs, scripting, webNavigation). The GemStone install forges Secure Preferences to avoid the Web Store, so an extension present without a corresponding Web Store install is a strong signal.

For browser and platform teams:

• A malicious extension masquerading as an AI "Gemini" companion, installed by forging Secure Preferences HMAC, is a reminder that side-loaded/forced-installed extensions are a live post-exploitation vector. Enforce enterprise extension allowlisting, monitor for Secure Preferences tampering, and treat the browser's extension surface as part of the endpoint attack surface, not a convenience feature.

For leadership and threat intel:

• The story here is capability diffusion: four espionage actors fielding the same chain within ~12 days suggests exploit kits are being shared or sold among state-aligned groups, compressing the time between a bug's disclosure and its use by multiple actors. Threat models that assume one exploit equals one actor understate this; assume that a patch-gap zero-day, once seen, is available to several.

Sources