sec/bites
← All research

15 min read

BlueMoon Exploit Kit Threat Research and Hunting Hypotheses

Evidence-based analysis of BlueMoon exploitation, campaigns, vulnerabilities, evasion methods, indicators, ATT&CK mappings, and detection opportunities

Executive Summary

BlueMoon is Proofpoint’s name for a browser exploit kit first observed on August 28, 2026. It was used by several espionage-focused threat clusters in targeted spearphishing campaigns. The kit chains two Chromium V8 vulnerabilities with a Microsoft Windows kernel privilege-escalation vulnerability, injects into the Chromium browser broker process, and executes an operator-selected payload.

The first documented user was TA412, also known as JungleBamboo, Violet Typhoon, APT31, and TIDE CASTLE. Within days, UTA0560, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket used the same underlying capability against organizations in the United States, Vietnam, Indonesia, and Singapore. Most documented activity is assessed as China-aligned espionage, but UNK_DoubleCheck remains country-unattributed.

BlueMoon exploited a narrow patch gap. Fixes for its Chromium vulnerabilities were visible in upstream source before reaching stable Chrome releases. The kit’s rapid adoption and substantially shared exploit code suggest a common supplier or dissemination channel. Public evidence does not establish the developer, a commercial broker, the acquisition method, or exclusive control by a state-aligned organization.

The default post-exploitation process chain is highly detectable: chrome.exe launches cmd.exe, which launches curl.exe, writes msgbox.exe beneath %TEMP%, and executes it. Other durable opportunities include browser-to-shell execution, suspicious msiexec.exe use, extension preference tampering, scheduled task creation, DLL side-loading, DNS-over-HTTPS (DoH) resolution, and recently created exploit-delivery infrastructure.

Research Scope and Analytical Guardrails

Research covers public reporting available through September 11, 2026. Primary technical sources are Proofpoint and Volexity, supported by NVD and MITRE ATT&CK references.

Evidence labels used in this report are:

  • Observed: documented in provider or incident telemetry
  • Analyzed: present in an exploit, loader, payload, or configuration sample
  • Reported: stated by a source but not independently reproduced for this report
  • Inferred: a testable analytical proposition rather than a confirmed behavior

No claim of query validation, detection coverage, or optimization gain is made without execution against representative telemetry. Exact Microsoft Defender XDR and Microsoft Sentinel fields must be confirmed against the schemas in the target environment. Personally identifiable information is omitted unless it is directly relevant to a defensive observable.

BlueMoon in this report means the Proofpoint-tracked 2026 exploit kit. It must not be conflated with unrelated software or malware that uses a similar name.

Operational Assessment

BlueMoon is not documented as a conventional mass-market exploit kit. All reviewed deployments used targeted spearphishing. No reviewed evidence supports delivery through malvertising, Flash, Java, or a general-purpose traffic distribution system.

The kit provides a reusable exploitation layer. Operators supply their own landing pages, redirects, infrastructure, post-exploitation commands, and payloads. This separation explains how distinct clusters could use identical or substantially similar exploit stages while delivering unrelated malware.

The observed chain combines:

  • A crafted HTML or JavaScript landing page
  • Chromium and Windows version checks
  • A V8 renderer exploit
  • A V8 sandbox escape
  • Host reconnaissance and exploit gating
  • Windows kernel privilege escalation
  • Injection into the Chromium broker process
  • Operator-selected payload retrieval and execution

Proofpoint and Volexity assess that public upstream Chromium fixes were likely reverse-engineered during the stable-release delay. This is an analytical assessment, not confirmed developer provenance.

Infection and Attack Flow

Stage Behavior Evidence
Targeting Send targeted emails using internships, conferences, donations, vaccination registration, or request-for-quotation themes Observed
Link delivery Direct a recipient to actor infrastructure, sometimes through a reflected cross-site scripting redirect on a legitimate site Observed
Decoy presentation Display a target-relevant image or loading page while a hidden iframe loads the exploit Observed and analyzed
Client gating Check the browser user agent and operating system, proceeding only for supported Chromium on Windows combinations Analyzed
V8 exploitation Exploit CVE-2026-85046 to obtain arbitrary read and write capability within the V8 heap cage Analyzed
V8 sandbox escape Exploit CVE-2026-87491 by corrupting WebAssembly metadata to execute the embedded first native stage Analyzed
Host profiling Collect Windows build, process-token, integrity, processor, debugger, sandbox, and hypervisor data Analyzed
Privilege escalation Exploit CVE-2026-85880 to obtain kernel read and write and enable SeDebugPrivilege in the renderer token Analyzed
Broker injection Inject a CreateProcessA stub and command line into the Chromium broker process Analyzed
Payload delivery Use cmd.exe and curl.exe, or a customized launcher, to retrieve and run an operator-selected payload Observed and analyzed
Post-exploitation Install a browser-surveillance extension, GRIMWEDGE, ShadowPad, a Rust loader chain, or custom .NET malware Observed and analyzed by campaign

Exploit orchestration

The exploit page can hold JavaScript inert in text/plain script blocks, concatenate it at runtime, and launch it in a Web Worker. Worker execution reduces visible disruption because a recoverable exploit failure does not necessarily terminate the tab displaying the decoy.

The orchestrator stores an attempt count in the v8ctf_exp_attempt sessionStorage key and retries recoverable failures up to five times. URL parameters expose development and operator controls, including mode=payload, exeurl, force2, forcepp, retry, runpayload, stopAfter, and worker. The exeurl parameter separates the reusable exploit from the final payload.

Three large Base64-encoded components are embedded in reviewed variants:

  • p1 reflectively loads reconnaissance code
  • p2 reflectively loads the Windows kernel exploit
  • pp injects a process-creation stub into the browser broker

The default final command follows this behavioral pattern:

chrome.exe -> cmd.exe -> curl.exe -> %TEMP%\msgbox.exe

Host profiling and exploit gating

The p1 stage collects the operating system and build, process-token privileges, integrity level, AppContainer state, CPU features, and hypervisor vendor. It also reports debugger and sandbox indicators. Volexity found these anti-analysis checks to be passive in the DLL: JavaScript decides whether to continue.

The kernel stage was gated to selected older builds, including Windows 10 1809 through 22H2, Windows Server 2019 and 2022, and Windows 11 21H2. This reduced the viable target population despite the browser vulnerabilities being present in current stable releases during the patch gap.

Associated Vulnerabilities

Vulnerability Function in the chain Affected product information Status
CVE-2026-85046 V8 type confusion used to obtain heap read and write primitives Google Chrome before 152.0.7977.82; V8 before 15.3.48 Added to CISA KEV on September 4, 2026
CVE-2026-87491 V8 out-of-bounds write used through corrupted WebAssembly metadata Google Chrome before 153.0.8010.36 Added to CISA KEV on September 9, 2026
CVE-2026-85880 Windows ALPC kernel heap-based buffer overflow used for local privilege escalation Multiple Windows 10 and Windows Server builds Added to CISA KEV on September 8, 2026

Proofpoint contains a section heading that repeats CVE-2026-85046 for the V8 sandbox-escape stage. The body of that section, Volexity’s analysis, and NVD identify CVE-2026-87491 as the second V8 vulnerability.

Threat Actors and Campaigns

Actor or cluster First documented BlueMoon use Targets and themes Payload and objective Attribution confidence
TA412 / JungleBamboo / Violet Typhoon / APT31 / TIDE CASTLE August 28, 2026 US NGOs, mining companies, and commodity-trading firms; internships and conference outreach SUPERSTOMP installer and LONGTALE or GemStone browser-surveillance extension High confidence China-aligned actor identity
UTA0560 September 1, 2026 US NGOs; financial and donation themes GRIMWEDGE JScript backdoor for discovery, file access, command execution, and additional payload delivery High confidence continuity with earlier UTA0560 activity; China nexus reported by Volexity
UNK_LateNight September 2, 2026 US aerospace and defense supply-chain organizations; business and request-for-quotation themes ShadowPad delivered through DLL side-loading Assessed China-aligned
UNK_DoubleCheck September 2, 2026 Vietnamese manufacturer; vaccination-registration lure sent from a compromised government mailbox Rust loader and multi-stage DLL side-loading chain Espionage motivation likely; country attribution unresolved
UNK_QuietRacket September 3, 2026 Indonesian and Singaporean government, consulting, and financial organizations; conference themes Custom .NET malware with DoH-based C2 discovery Suspected China-aligned

Proofpoint describes four clusters in its report: TA412, UNK_LateNight, UNK_DoubleCheck, and UNK_QuietRacket. Volexity separately documents UTA0560 and TA412 or JungleBamboo using the shared chain. Counting the distinct public designators across both reports yields five documented clusters, but vendor tracking systems can overlap as attribution evolves.

TA412 and JungleBamboo

TA412 used rapport-building and tailored spearphishing links. Successful exploitation installed a malicious Chromium extension disguised as a Google Gemini browsing assistant. Proofpoint calls the extension GemStone. Volexity calls the installer SUPERSTOMP and the extension LONGTALE.

The extension can collect keystrokes, form input, pasted content, cookies, local and session storage, navigation metadata, and screenshots. It can also make arbitrary HTTP requests from the browser context. C2 paths include /api/extensions/register, /heartbeat, /ingest, /screenshots, and /commands.

UTA0560

UTA0560 abused a reflected cross-site scripting condition on a legitimate site to redirect recipients to an exploit landing page. A decoy donation form remained visible while the exploit ran in a hidden iframe.

The initial loader established scheduled-task persistence and requested a victim-specific path containing %COMPUTERNAME%.txt. A returned MSI was saved as %TEMP%\Temp.txt and invoked with msiexec.exe /i. An obfuscated JScript custom action evaluated C2 responses in memory inside msiexec.exe. Volexity tracks the backdoor as GRIMWEDGE.

UNK_LateNight

UNK_LateNight delivered ShadowPad through a DLL side-loading chain. An AES- encrypted TMP payload was decrypted and injected into a selected process. The chain stored a backup payload in the registry and created the scheduled task EdgeCore_AutoUpdate.

The reviewed ShadowPad sample unhooked network-monitoring functions, accessed Firefox profile data, sniffed network traffic, and communicated over HTTPS using rotating user-agent strings.

UNK_DoubleCheck

UNK_DoubleCheck used a Cloudflare Worker to deliver the only Proofpoint-observed variant specifically described as obfuscating the loader and configuration. Its customized command downloaded several files to a Microsoft Windows directory beneath %APPDATA% and initiated DLL side-loading.

The loader RC4-decrypted SysPr.prx, loaded a Rust executable in memory, and retrieved a second side-loading set from Cloudflare R2. Reported persistence included scheduled tasks and a COM-related registry value.

UNK_QuietRacket

UNK_QuietRacket customized the final injector to retrieve a DLL side-loading pair. The malicious DLL queried Google DoH for TXT records, decrypted C2 data with ChaCha20, contacted Cloudflare Workers, decoded and decrypted an HTML body, and loaded a .NET assembly in memory.

The first retrieved assembly created a GeForceService scheduled task. The loader then entered a continuing DoH and Cloudflare Worker beacon loop. The complete capabilities of the final custom payload were not publicly available at the research cutoff.

Obfuscation and Detection-Avoidance Methods

Layer Method Defensive implication
Social engineering Target-specific decoys and post-exploit redirects to legitimate sites Preserve email, proxy, and redirect-chain evidence rather than relying on the final page
Loader Bundled, minified, encoded, obfuscated, or separately hosted JavaScript Match stable orchestration strings and behavior in addition to file hashes
Target selection Browser, operating-system, and build gating Non-target analysis environments may receive no exploit content
Browser execution Hidden iframe and Web Worker execution A visible decoy can remain intact while exploitation retries
Resilience sessionStorage retry counter and up to five attempts Look for repeated exploit requests and v8ctf_exp_attempt in inspected content
Payload embedding Base64-encoded native components inside JavaScript Decode inspected content before static signature evaluation
Memory execution Reflective DLL loading and in-memory shellcode Endpoint memory and behavior telemetry are more durable than file-only rules
Process context Injection into the Chromium broker process Browser-originated child processes can represent post-exploit execution
Configuration Runtime exeurl and query-controlled stages Final payloads and URLs can change without changing the exploit core
Infrastructure Cloudflare Workers, R2, and Tunnels Shared hosting requires sequence and process context to avoid broad blocking
C2 resolution DoH TXT records with ChaCha20-protected configuration Correlate DoH requests with subsequent Worker connections and loader behavior
Native loading DLL side-loading through legitimate executables Detect unusual colocated DLLs and execution from user-writable paths
Stored payloads AES, RC4, ChaCha20, registry backup, and immediate overwrite Monitor decryption, registry writes, and memory execution around signed binaries
Browser persistence Forged Secure Preferences HMAC and super_mac values Alert on browser termination, profile modification, extension insertion, and relaunch
Sensor interference ShadowPad network-function unhooking Combine endpoint, network, and identity evidence when endpoint visibility degrades
Script execution Obfuscated JScript evaluated from C2 responses inside msiexec.exe Detect unusual network and child-process behavior from Windows Installer

The kit contained verbose logging, debugging comments, a markdown handover reference, and v8CTF terminology. Proofpoint considers these artifacts consistent with possible AI-assisted development. They do not conclusively establish that an AI system developed the exploit or that v8CTF references reflect the real development environment.

MITRE ATT&CK Mapping

Phase Technique Confidence Evidence boundary
Initial access T1566.002 Phishing: Spearphishing Link High Targeted email links led to exploit infrastructure
User execution T1204.001 User Execution: Malicious Link High A recipient had to follow the delivered link
Execution T1203 Exploitation for Client Execution High Crafted HTML and JavaScript exploited Chromium
Discovery T1082 System Information Discovery High The reconnaissance stage collected OS, build, and processor data
Defense evasion T1497.001 Virtualization/Sandbox Evasion: System Checks Medium Hypervisor, debugger, and sandbox indicators were collected; campaign-specific gating decisions are incompletely documented
Privilege escalation T1068 Exploitation for Privilege Escalation High CVE-2026-85880 enabled elevated renderer privileges
Defense evasion T1055 Process Injection High Shellcode injected a process-creation stub into the Chromium broker
Execution T1059.003 Command and Scripting Interpreter: Windows Command Shell High Default and customized chains executed cmd.exe /c
Command and control T1105 Ingress Tool Transfer High curl.exe and loaders retrieved additional payloads
Defense evasion T1574.002 Hijack Execution Flow: DLL Side-Loading High Multiple campaign payloads used legitimate executable and malicious DLL pairs
Defense evasion T1027 Obfuscated Files or Information High JavaScript and payload components used encoding, encryption, or obfuscation
Persistence T1053.005 Scheduled Task/Job: Scheduled Task High Campaigns created named scheduled tasks
Persistence T1112 Modify Registry High UNK_LateNight and UNK_DoubleCheck wrote persistence or payload material to the registry
Persistence T1176 Browser Extensions High TA412 installed a malicious Chromium extension
Credential access T1555.003 Credentials from Web Browsers High LONGTALE or GemStone stole browser cookies and storage; ShadowPad accessed Firefox profiles
Collection T1056.001 Input Capture: Keylogging High The malicious extension captured keyboard, input, change, and paste events
Collection T1113 Screen Capture High The malicious extension captured and uploaded screenshots
Command and control T1071.001 Application Layer Protocol: Web Protocols High Payloads used HTTPS and Cloudflare-hosted services
Command and control T1071.004 Application Layer Protocol: DNS Medium UNK_QuietRacket used DoH TXT records for C2 resolution

Mappings after exploitation are payload-specific. They should not be treated as capabilities present in every BlueMoon deployment. Technique identifiers must be checked against the ATT&CK version used by the consuming detection program before publication.

Hunting and Detection Hypotheses

H1 Browser-spawned download and execution

Hypothesis: Successful default BlueMoon exploitation produces a Chromium browser to command shell to download utility to temporary executable sequence.

  • Telemetry: process creation, command lines, file creation, file execution, network connections, browser process ancestry
  • Logic: identify chrome.exe, msedge.exe, brave.exe, or vivaldi.exe spawning cmd.exe, followed by curl.exe, a write beneath %TEMP%, and execution of the written file within a short interval
  • Expected false positives: developer workflows, browser-based enterprise management, and unusual updater components
  • Validation gap: confirm whether endpoint telemetry preserves the injected broker process as the initiating process in the target environment

H2 Browser-to-shell anomaly

Hypothesis: A Chromium process that directly or indirectly launches cmd.exe, powershell.exe, msiexec.exe, rundll32.exe, or an unsigned binary from a user-writable directory represents exploit or extension abuse.

  • Telemetry: process events, signer data, file origin, browser extension inventory
  • Logic: score rare browser child processes and increase severity for downloads, temporary paths, encoded commands, or recently created files
  • Expected false positives: browser updaters, endpoint support tools, and approved extensions
  • Validation gap: establish an organizational baseline for legitimate browser child processes

H3 Disguised MSI staging

Hypothesis: UTA0560-like activity executes an MSI stored with a non-MSI extension under a temporary directory.

  • Telemetry: process creation, file type or magic bytes, file creation, network events
  • Logic: detect msiexec.exe /i targeting .txt or another unexpected extension, especially %TEMP%\Temp.txt
  • Expected false positives: administrative packaging that deliberately renames installers
  • Validation gap: file content inspection may be unavailable after rapid cleanup

H4 Browser extension preference tampering

Hypothesis: TA412 terminates Chromium browsers, modifies Secure Preferences and extension directories, then relaunches a browser with --restore-last-session.

  • Telemetry: process termination and creation, browser-profile file writes, extension inventory, signer information
  • Logic: correlate browser termination with writes to extension and preference paths by a non-browser process, followed by browser relaunch
  • Expected false positives: legitimate browser-management or profile-migration products
  • Validation gap: Defender file telemetry may not expose individual JSON keys or HMAC changes

H5 Named scheduled-task persistence

Hypothesis: Known BlueMoon payload chains create one of several campaign task names.

  • Telemetry: scheduled-task events, registry events, schtasks.exe command lines, PowerShell operational logs
  • Logic: detect EdgeCore_AutoUpdate, MicrosoftEdgeUpdatesTaskMachine, Avpcheckup, GeForceService, or Windows Scheduled System; enrich with task action path and signer
  • Expected false positives: task-name collision with legitimate software
  • Validation gap: exact-name rules are brittle and must be paired with behavioral task-action logic

H6 DoH TXT-driven C2

Hypothesis: UNK_QuietRacket loaders query a public DoH endpoint for a TXT record and soon connect to a Cloudflare Worker to retrieve encrypted content.

  • Telemetry: DNS, proxy, TLS destination, process network, memory or module loading
  • Logic: correlate a non-browser process contacting Google DoH with TXT-like requests, a subsequent workers.dev connection, and .NET assembly or side-loaded DLL execution
  • Expected false positives: legitimate DoH clients and software using Cloudflare Workers
  • Validation gap: encrypted DoH can obscure the requested record without endpoint or proxy visibility

H7 Victim-specific GRIMWEDGE staging

Hypothesis: A loader repeatedly requests a URL containing the computer name, then writes an MSI as Temp.txt and invokes Windows Installer.

  • Telemetry: proxy URL paths, process events, file events, scheduled tasks
  • Logic: correlate repeated requests ending in .txt with the device name, creation of %TEMP%\Temp.txt, and msiexec.exe /i
  • Expected false positives: internal inventory agents that use hostnames in request paths
  • Validation gap: URL path visibility requires proxy logging or TLS inspection

H8 BlueMoon web-content markers

Hypothesis: Inspected exploit content contains stable orchestration markers despite campaign-specific packaging.

  • Telemetry: secure web gateway content, network detection sensor, downloaded JavaScript, browser forensics
  • Logic: search decoded content for combinations of v8ctf_exp_attempt, CVE_EXP_CORE, CVE_EXP_NO_D8_DRIVER, CVE_PROFILE, PAYLOADS_B64, mode=payload, exeurl=, forcepp, and stopAfter
  • Expected false positives: security research, proof-of-concept testing, and copied reporting artifacts
  • Validation gap: HTTPS inspection and Base64 decoding are required for broad visibility

H9 Patch-gap exposure correlation

Hypothesis: Devices with vulnerable Chromium and Windows combinations that interact with a spearphishing link have materially higher BlueMoon risk.

  • Telemetry: software inventory, Windows build inventory, email URL clicks, browser version, network events
  • Logic: join vulnerable browser versions and affected Windows builds with a recent suspicious link interaction or newly registered destination
  • Expected false positives: exposure indicates risk, not successful exploitation
  • Validation gap: inventory and email telemetry can be delayed or incomplete

H10 GemStone or LONGTALE browser C2

Hypothesis: A malicious Chromium extension registers a victim and regularly uses a characteristic set of API paths for heartbeat, collection, screenshots, and commands.

  • Telemetry: proxy URL paths, browser extension inventory, process network events, profile file events
  • Logic: correlate /api/extensions/register with repeated /heartbeat, /ingest, /screenshots, or /commands requests from a browser that has a recently installed unpacked extension
  • Expected false positives: benign APIs can use similar generic paths
  • Validation gap: path-only matching is insufficient without extension or infrastructure context

Selected Indicators

Indicators are historical and can be repurposed, expired, or shared with legitimate tenants. Enrich domains, IP addresses, certificates, hosting relationships, and first-seen dates before operational action.

Type Indicator Context
SHA-256 7a52ff23949edee8faa61ce0def6dbca8b7e5943c54d23376cc190762ea3985c Shared exploit page
SHA-256 51462a23ac25e1bd0e49b7cae7f3a71f8d2201e22d45175b587e4740b49863cc Shared Windows LPE DLL
SHA-256 69c1603f3f9015beb0097d0a3bb0f17400c314e2eae65a7eceacd3b93ea570dc UTA0560 GRIMWEDGE dropper
SHA-256 56eda0ac82e06ee609b034306025e67df161c5877399c305c8eaea136e80c951 UTA0560 MSI named Temp.txt
SHA-256 e2a59432ce2b0d83ded936374a11fca3d3defaf4aab90eb37fca58683eae32c0 JungleBamboo SUPERSTOMP installer
SHA-256 5eb5645511b00e4f4d73125654eeb3a3930fcf09c65685dc7f03f725331492e3 LONGTALE extension
Domain cloud.shinewrist.net UTA0560 exploit hosting and C2
Domain ocr.opusaccel.top GRIMWEDGE C2
Domain msbenefit.com JungleBamboo delivery infrastructure
Domain gitprogram.com JungleBamboo exploit and payload hosting
Domain ms.checrity.com UNK_LateNight ShadowPad C2
Domain homepage.brianwilli.com UNK_DoubleCheck downloads
Domain fracons.com UNK_DoubleCheck C2
Domain dns.elixnovorem.com UNK_QuietRacket DoH lookup
Domain dns.getaiexo.com UNK_QuietRacket DoH lookup
IP address 206.166.251.164 UTA0560 hosting
IP address 79.133.56.90 ShadowPad fallback C2
File path %TEMP%\msgbox.exe Default downloaded payload name
File path C:\Users\Public\stomp_ext Malicious extension extraction directory
Mutex Dataupcheckinfo UNK_DoubleCheck artifact
Registry path HKCU\SOFTWARE\Classes\CLSID\{5D4CFCB7-222C-4CA3-96B6-1F8195FBBB4B}\InprocServer32 UNK_DoubleCheck persistence

Proofpoint also published Emerging Threats signatures 2071919 through 2071923 and a YARA rule for BlueMoon exploit components. These controls must be tested against local traffic, content inspection, and file collections before production deployment.

Defensive Priorities

  1. Update Chrome and other Chromium-based browsers beyond affected versions.
  2. Apply Microsoft security updates for CVE-2026-85880 and prioritize exposed combinations listed in CISA KEV.
  3. Hunt for browser-to-shell ancestry and %TEMP%\msgbox.exe execution.
  4. Review browser extension inventory, unpacked extensions, and recent Secure Preferences modifications.
  5. Review suspicious scheduled tasks and DLL side-loading from user-writable directories.
  6. Correlate DoH TXT activity with Cloudflare Worker connections and in-memory loading.
  7. Preserve email, redirect, browser, process, file, registry, task, and proxy telemetry when investigating suspected exploitation.

Intelligence Gaps

Public reporting does not currently establish:

  • The BlueMoon developer or exploit supplier
  • Whether the capability was sold commercially or distributed by another mechanism
  • Exclusive ownership or control by a China-aligned organization
  • Reliable victim or successful-compromise counts
  • Use through malvertising, Flash, Java, or a commercial traffic distribution system
  • Complete capabilities of the UNK_DoubleCheck and UNK_QuietRacket payloads
  • Whether AI systems materially contributed to exploit development
  • Whether every public cluster remains distinct as vendor attribution evolves

These gaps should remain explicit in finished intelligence and detection documentation. Shared exploit code supports a common-sourcing hypothesis, not common operational ownership.

Sources