Proofpoint says four hacking groups share one Chrome exploit kit

Security firm Proofpoint said on Wednesday that at least four hacking groups have been running a nearly identical exploit kit against Chromium-based browsers and older versions of Windows, Ars Technica reports. Proofpoint calls the kit BlueMoon and says it chains three vulnerabilities together, giving whoever runs it a way to install malware of their choice. All three bugs received patches in the past 24 hours.

Two of the three flaws are in V8, Google's open source JavaScript engine used inside Chrome and every other Chromium browser. Attackers combined a V8 type confusion bug with a separate V8 sandbox escape to execute code, then chained a Windows kernel vulnerability to break out of the browser sandbox. The Windows bug affects the October 2018 update of Windows 10 and 11's initial release, alongside Windows Server 2019 and 2022.

The pace is what changed

A working Chrome attack chain used to be a rare, high-value capability that a single group would use sparingly to keep it working longer. Proofpoint said BlueMoon looked nothing like that. It was developed, deployed and shared across multiple groups within days, in a way that was easy to detect. The company points to two likely contributors.

The first is the Chromium patch gap. Chromium fixes are public in the upstream repository before Chrome, Edge and other downstream browsers release a build that includes them, which gives attackers time to study a patch and build an exploit before most users receive it. The second, Proofpoint says, is AI. "This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development," the company wrote in its report, quoted by Ars.

Who was attacked

Ars, quoting Proofpoint, names four groups. TA412, a China-aligned state-sponsored actor indicted by the US government in 2024, attacked non-governmental organisations, mining companies and physical commodity trading firms in the US. UNK_LateNight, a second China-aligned espionage group, targeted multiple US aerospace companies. UNK_DoubleCheck targeted a Vietnamese manufacturing entity. UNK_QuietRacket attacked organisations in Singapore and Indonesia. The first campaign began on 28 August; the rest started earlier this month. Proofpoint says it does not know whether other groups also have the kit.

What to check today

Anyone running an Electron app, an embedded Chromium build, or Microsoft Edge on old Windows should force an update rather than trust a scheduled rollout. Server operators on Windows Server 2019 or 2022 need the Windows kernel patch with the same urgency. The patch-gap point applies beyond this specific chain: a public upstream Chromium fix is now, on the evidence of BlueMoon, enough time for four groups to build exploits from it. If your releases fall far behind an upstream security fix, that delay is a release decision, not a technical one.

Source

• Ars Technica: 4 groups caught using the same Chrome and Windows exploit kit, by Dan Goodin, 9 September 2026.
• Referenced: Proofpoint research on the BlueMoon kit.