Four espionage crews, most China-linked, ran the same Chrome exploit kit through a four-week patch gap

Proofpoint said Wednesday that at least four cyber-espionage groups, most linked to Chinese state intelligence, have used the same previously unknown Google Chrome vulnerability in attacks beginning late August and continuing into this week.

The groups used the same exploit kit, dubbed BlueMoon by Proofpoint, to compromise Chrome browsers and deploy malware against U.S. defense contractors, NGOs and Southeast Asian government agencies.

Two additional groups are also believed to have used the BlueMoon kit, according to Proofpoint's researchers, who said they expected further reporting on the campaign from other security companies.

Proofpoint said the final step is surprisingly crude, using the common curl command-line tool to download a malicious file into a temporary folder, actions that give security software multiple opportunities to detect the attack.

Kelly said the sloppiness likely reflected the race to use the exploit before Chrome users received the patch.

Proofpoint said the hackers were separate groups conducting separate operations, pursuing different targets and using their own malware and command-and-control infrastructure, but that the exploit kit was definitely shared between them.

Mark Kelly, a threat researcher at Proofpoint, said in an interview with Recorded Future News: "There's no way that this is parallel development. The code is practically identical - even the variable naming, the commentary. It's the same kit. One hundred percent."

The first group Proofpoint observed using the exploit kit was TA412, also tracked as APT31, Violet Typhoon and RedBravo, which began doing so at the end of August.

Proofpoint said TA412 targeted U.S. NGOs, mining companies and commodity traders using lures including fake internship inquiries and messages about an Asian Studies conference, and installed a malicious browser extension disguised as Google's Gemini AI assistant that "functions as a browser-surveillance and credential-theft backdoor."

Evidence suggests artificial intelligence may have aided in the development of the BlueMoon exploit kit, potentially accelerating the process of weaponizing patches.

U.S. authorities indicted a number of Chinese individuals accused of working for TA412 in 2024, and sanctioned a Wuhan-based company associated with its attacks on critical infrastructure and believed to be a front for China's Ministry of State Security.

A second group, tracked as UNK_LateNight, used BlueMoon to target U.S. aerospace and defense companies with fake procurement inquiries and installed ShadowPad, a backdoor widely used by Chinese state hackers.

A third group, UNK_DoubleCheck, targeted a Vietnamese manufacturer, and a fourth, UNK_QuietRacket, targeted organizations in Indonesia and Singapore.

Kelly said the four-week gap had historically been "pretty reasonable" because reverse-engineering and weaponizing a patch within that period had been rare, and that "that seems to no longer be the case."

The episode fits a recurring pattern in which otherwise separate China-linked hackers gain access to the same offensive tooling at about the same time, raising questions about whether the groups are supplied by the government or a shared contractor, or whether the tools are sold to multiple threat actors by a broader commercial market.

Confirmed and suspected users of BlueMoon total at least six groups.

Google on Tuesday began moving Chrome to a two-week release cycle, partially to get security fixes to users faster.

Neither published account identifies the two browser flaws or the Windows vulnerability by CVE number; they are described only as two browser flaws plus a Windows vulnerability in the BlueMoon kit.

Moving Chrome to a two-week release cycle reduces the study window between a public Chromium fix and stable-channel delivery from about 28 days to about 14.