Affected Systems

Microsoft Windows (CVE-2026-85880: heap-based buffer overflow in ALPC, older builds targeted); Google Chrome and Chromium-based browsers (CVE-2026-85046: V8 type confusion; CVE-2026-87491: V8 sandbox escape). All three zero-days chained for remote code execution, sandbox escape, and privilege escalation. Observed in active campaigns since August 28, 2026.

Exploitation Status

Active exploitation confirmed. Multiple cyber-espionage groups (JungleBamboo/APT31, UTA0560, UNK_LateNight, UNK_DoubleCheck) deployed BlueMoon in spearphishing campaigns targeting NGOs, aerospace, defense, and manufacturing sectors. CVE-2026-85880 suspected exploited since 2025 before repackaging into BlueMoon. Proofpoint and Volexity observed attacks starting August 28, 2026.

Business Impact

High-severity threat to organizations using Windows and Chrome/Chromium browsers. Attackers achieve full system compromise via spearphishing: initial browser exploit leads to sandbox escape, then Windows kernel privilege escalation, enabling arbitrary code execution and malware deployment (credential stealers, backdoors). Primarily espionage-focused but expected to spread to financially motivated actors. Targets include U.S. NGOs, aerospace, defense contractors, and Vietnamese manufacturing. Defenders must patch immediately and hunt for compromise using published IOCs.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Microsoft patches for CVE-2026-85880 (Windows ALPC heap overflow) and Google Chrome updates addressing CVE-2026-85046 and CVE-2026-87491 immediately across all endpoints.
  • Hunt for BlueMoon activity using IOCs published by Proofpoint and Volexity: check for curl.exe spawned by Chrome renderer processes, executables dropped in %TEMP%, and network connections to known C2 infrastructure.
  • Review email logs for spearphishing lures related to donations, NGO topics, or aerospace/defense themes; block sender domains and attachments matching campaign patterns.
  • Monitor Chrome renderer process behavior for privilege escalation attempts and injection into parent Chrome processes; enable enhanced logging for ALPC and V8 sandbox violations if available.
  • Isolate and forensically analyze systems in targeted sectors (NGOs, aerospace, defense, manufacturing) for Longtale/GemStone extensions, Grimwedge JScript backdoor, ShadowPad, or unknown Rust loaders.