Four state-linked hacking groups rapidly weaponize shared Chrome and Windows exploit kit

Multiple threat groups with suspected Chinese government ties have mobilized a newly developed exploit toolkit dubbed BlueMoon, which chains together vulnerabilities in Chrome-based browsers and Windows operating systems to deliver custom malware. Proofpoint researchers documented the activity this week, revealing an unusually rapid deployment cycle compared to historical norms in the threat landscape.

How BlueMoon works#

The toolkit combines three separate security flaws into a single attack chain. Two vulnerabilities affect Chromium—the open-source foundation for Chrome, Edge, and other browsers—while a third targets the Windows kernel across multiple versions including Windows 10 (October 2018 Update), Windows Server 2019, Windows 10 version 2004, Windows Server 2022, and initial Windows 11 builds. Collectively, these exploits grant attackers the capability to bypass browser sandboxes and execute malware with elevated system privileges. Patches for all three flaws became available within 24 hours of the research publication.

Exploitation of the "patch gap"#

Rather than hoarding their capability as exclusive tools, the attackers distributed BlueMoon widely among multiple groups—a departure from historical practice where Chrome exploits remained closely guarded. Researchers attribute this rapid sharing to two pressures colliding: a narrow window of vulnerability exists between when developers release patches and when those patches reach end-user browsers like Chrome and Edge. Additionally, the involvement of AI-powered vulnerability discovery tools likely accelerated both the identification and weaponization of these flaws.

As Proofpoint noted, the tactic reflects changing economics in the threat landscape. Where Chrome exploit chains once represented rare, high-value assets jealously protected by individual groups, automation and AI tools have lowered the barrier to entry for developing such capabilities. Open-source projects like Chromium, where patches are published publicly before downstream consumers deploy them, create exploitable windows that machine learning systems can rapidly reverse-engineer.

Broad targeting#

The four groups deploying BlueMoon cast wide nets across organizations and sectors, though specific targets remain partially redacted in Proofpoint's disclosure. The visible deployment and high detection signals stand in stark contrast to the surgical precision most sophisticated campaigns employ, underscoring both the competitive rush to exploit the vulnerability window and confidence among the attackers that rapid, noisy attacks outweigh the risks of detection.