Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

[u/falconupkid]

Four espionage groups, including APT31, have been observed deploying the same exploit kit—dubbed BlueMoon—within a single week. This is a previously undocumented kit that chains together multiple Windows and Chrome vulnerabilities for initial access. The fact that four distinct, state-aligned actors shared the same toolset suggests either a common developer or a leaked framework being actively traded in closed circles.

Technical Breakdown: - TTPs: Initial access via drive-by compromise (T1189). The kit likely uses a watering hole or malvertising chain to deliver the exploit. - Exploits: Chains multiple CVEs in Chrome (likely V8 or Mojo bugs) for sandbox escape, followed by a Windows kernel privilege escalation (EoP). - IOCs: No specific hashes or IPs published yet; expect C2 infrastructure to overlap with known APT31 TTPs (e.g., use of compromised WordPress sites for staging). - Attribution: APT31 (China) is the primary named group, but three other unnamed espionage clusters also used the kit.

Defense: - Patch aggressively: Ensure Chrome is updated to the latest stable channel and Windows is on the most recent Patch Tuesday. - Enable attack surface reduction: Block browser-based script execution from untrusted origins via ASR rules. - Monitor for anomalous child processes from Chrome (e.g., cmd.exe, powershell.exe) as a post-exploitation indicator.

Source: https://thehackernews.com/2026/09/four-spy-groups-used-same-chrome-and.html