Multiple espionage-motivated threat activity clusters have been observed deploying a previously undocumented exploit kit named BlueMoon. The kit chains together multiple vulnerabilities in Microsoft Windows and Google Chrome to gain initial access for in-the-wild espionage operations. Four distinct threat groups were observed using the kit within a single week, marking a significant concentration of coordinated activity. The first attributed use has been linked to APT31, a China-aligned state-sponsored group, with additional clusters also identified. No specific victim counts or data exfiltration details have been disclosed.

Which products are affected?

Google Chrome, Microsoft Windows

What should defenders do?

Ensure Microsoft Windows and Google Chrome are updated to the latest secure versions available. Apply vendor patches as released. Monitor for indicators of compromise associated with BlueMoon exploitation chains. Implement network segmentation and least-privilege principles to limit impact from initial access.

highThreat Intelligence

Four Espionage Groups Deploy BlueMoon Exploit Kit Chaining Windows and Chrome Vulnerabilities

Coordinated in-the-wild attacks attributed to China-aligned state-sponsored threat actors leverage a previously undocumented exploit chain.

CyberIntel DeskPublished 20 days agoUpdated less than a minute ago1 min read

Four Espionage Groups Deploy BlueMoon Exploit Kit Chaining Windows and Chrome Vulnerabilities

Key Takeaways

Four espionage-motivated threat clusters deployed the previously undocumented BlueMoon exploit kit within a single week.
The kit chains vulnerabilities in Microsoft Windows and Google Chrome for in-the-wild espionage access.
APT31, a China-aligned state-sponsored group, is the first attributed user of BlueMoon.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read