BlueMoon exploit kit turns Chrome and Windows flaws into attacks

Strategic summary

The BlueMoon exploit kit combines two Chrome V8 JavaScript engine vulnerabilities and a Windows vulnerability to execute code with elevated privileges after phishing clicks. Proofpoint observed four espionage groups using the same exploit chain within days of each other after upstream fixes became publicly visible. All three vulnerabilities have been added to CISA's Known Exploited Vulnerabilities catalog. The report shows attackers analyze patches and move faster than many users expect, so actively exploited vulnerabilities should be prioritized.

Key findings

• BlueMoon uses two Chrome V8 vulnerabilities and one Windows vulnerability to bypass browser protections and gain higher privileges after a phishing click.
• Four espionage groups used the same exploit chain within days, indicating rapid dissemination after publicly visible upstream fixes.
• All three vulnerabilities were added to CISA's Known Exploited Vulnerabilities (KEV) catalog.
• Researchers found clues, but no conclusive evidence, that the exploit kit was developed with AI assistance.
• The gap between upstream fix and widespread protection is increasingly valuable to attackers, so prompt updates and prioritization based on the KEV list are critical.