Four groups caught using the same Chrome and Windows exploit kit
Four groups caught using the same Chrome and Windows exploit kit
四个黑客组织被发现使用同一套 Chrome 和 Windows 漏洞利用工具包
A nearly identical exploit kit that targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows is being actively used by at least four hacking groups, some of which have ties to the Chinese government. Researchers from security firm Proofpoint said Wednesday that BlueMoon, the name they gave to the kit, chains three vulnerabilities together so the attackers using it can install malware of their choice.
一套针对 Chromium 内核浏览器及旧版本 Windows 系统关键漏洞的近乎相同的漏洞利用工具包，正被至少四个黑客组织积极使用，其中一些组织与中国政府有关联。安全公司 Proofpoint 的研究人员周三表示，他们将该工具包命名为“BlueMoon”。它将三个漏洞串联在一起，使攻击者能够借此安装他们选择的恶意软件。
BlueMoon exploits two Chromium vulnerabilities and one in the kernel of Windows 10 (Oct. 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities have received patches in the past 24 hours.
BlueMoon 利用了两个 Chromium 漏洞以及一个存在于 Windows 10（2018 年 10 月更新版）、Windows Server 2019、Windows 10 2004、Windows Server 2022 和 Windows 11 初始版本内核中的漏洞。这三个漏洞均已在过去 24 小时内获得修复。
Deployed rapidly, widely shared
快速部署，广泛共享
The attacks lacked the stealth found in many campaigns. More often, hackers want to exploit newly discovered vulnerabilities sparingly to lengthen their longevity. Proofpoint hypothesized that one reason for the widely used and visible exploit chain was to take advantage of a “patch gap” in the Chromium supply chain, which spans the time a patch is available from developers and the time that patch is incorporated into browsers such as Chrome and Edge. Another likely contributor was the use of AI, which can often spot vulnerabilities faster than discovery performed solely by humans. Both these factors likely pushed the attackers to move quickly before a window of opportunity closed.
这些攻击缺乏许多网络行动中常见的隐蔽性。通常情况下，黑客为了延长漏洞的利用寿命，会谨慎地使用新发现的漏洞。Proofpoint 推测，该漏洞利用链之所以被广泛使用且显眼，原因之一是为了利用 Chromium 供应链中的“补丁滞后”（patch gap）——即从开发者发布补丁到补丁被整合进 Chrome 和 Edge 等浏览器之间的时间差。另一个可能的促成因素是人工智能的使用，它往往比纯人工发现漏洞的速度更快。这两个因素很可能促使攻击者在机会窗口关闭前迅速采取行动。
Proofpoint said: A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.
Proofpoint 表示：“一套完全武器化的 Chrome 漏洞利用链在历史上一直是一种高价值且罕见的能力。BlueMoon 在几天内就被开发、快速部署并共享给多个威胁行为者，且其方式具有很高的检测信号。这可能反映了此类能力的成本和准入门槛正在降低，因为人工智能代理正越来越多地助力威胁行为者进行漏洞开发。对于 Chromium 等开源代码库而言，这一点尤为突出，因为上游补丁在下游用户应用之前就已经公开可见。这为威胁行为者创造了一个窗口期，使他们能够尝试快速逆向工程补丁，并在下游稳定版本发布之前开发出漏洞利用程序。”
The four groups targeted a wide range of organizations and companies. The groups and targets included:
- TA412, a China-aligned state-sponsored threat actor indicted by the US government in 2024 on behalf of China’s civilian foreign intelligence agency, repeatedly hit organizations focused on non-governmental organizations, mining companies, and physical commodity trading firms in the US.
- UNK_LateNight, a China-aligned espionage group, targeted multiple US aerospace companies.
- UNK_DoubleCheck targeted a Vietnamese manufacturing entity.
- UNK_QuietRacket activity targeted Singapore and Indonesia.
这四个组织针对广泛的机构和公司进行了攻击。这些组织及其目标包括：
- TA412：一个与中国有关联的受国家支持的威胁行为者，曾于 2024 年被美国政府指控代表中国民用外国情报机构行事，该组织多次攻击专注于非政府组织、矿业公司和美国实物商品贸易公司的机构。
- UNK_LateNight：一个与中国有关联的间谍组织，针对多家美国航空航天公司。
- UNK_DoubleCheck：针对一家越南制造实体。
- UNK_QuietRacket：活动针对新加坡和印度尼西亚。
The first attack came from TA412 and began on August 28. The remainder began earlier this month. Proofpoint said it’s unknown if other groups also gained access to the exploit kit.
首次攻击来自 TA412，始于 8 月 28 日。其余攻击则始于本月初。Proofpoint 表示，尚不清楚是否有其他组织也获得了该漏洞利用工具包。
Both vulnerabilities targeting Chrome resided in V8, Google’s open source JavaScript engine. Exploiting a V8 type confusion bug and a separate sandbox escape in V8, the attackers were able to execute remote code. They then used a local privilege escalation in older versions of Windows to allow the malicious code to run with system rights. The first V8 vulnerability is tracked as CVE-2026-85046, and the Windows bug is tracked as CVE-2026-85880. Google doesn’t assign CVE designations for V8 sandbox escapes.
针对 Chrome 的两个漏洞都存在于 Google 的开源 JavaScript 引擎 V8 中。通过利用 V8 中的一个类型混淆漏洞和另一个独立的沙箱逃逸漏洞，攻击者能够执行远程代码。随后，他们利用旧版本 Windows 中的本地权限提升漏洞，使恶意代码能够以系统权限运行。第一个 V8 漏洞被追踪为 CVE-2026-85046，Windows 漏洞被追踪为 CVE-2026-85880。Google 不会为 V8 沙箱逃逸分配 CVE 编号。
“Both V8 vulnerabilities were ‘patch-gap’ zero-days at the time of the observed activity,” Proofpoint said. “In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public. It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”
“在观察到这些活动时，这两个 V8 漏洞都是‘补丁滞后’型的零日漏洞，”Proofpoint 表示。“换句话说，虽然它们是已经在公开的上游 Chromium 源代码中修复的已知漏洞，但在公众可用的 Chrome 和基于 Chromium 的浏览器的最新稳定版本中，它们仍未得到修复。漏洞利用工具包的开发者很可能利用了这些公开的 Chromium 补丁来武器化该浏览器漏洞利用链。”
Although BlueMoon leaves plenty of indications that it’s being used and all three vulnerabilities have been patched, Proofpoint said the kit may nonetheless continue to be used. “Given its ease of adoption, it is likely to proliferate further and be adopted by espionage-motivated and financially motivated threat actors as patched versions are fully rolled out across all Chromium-based browsers,” the researchers said.
尽管 BlueMoon 留下了大量被使用的痕迹，且所有三个漏洞都已得到修复，但 Proofpoint 表示该工具包仍可能继续被使用。研究人员称：“鉴于其易于采用的特性，随着补丁版本在所有基于 Chromium 的浏览器中全面推广，它很可能会进一步扩散，并被出于间谍目的和经济动机的威胁行为者所采用。”