Proofpoint disclosed a previously undocumented exploit kit called BlueMoon on 9 September 2026. It chains three flaws to get from a visited web page to code running on a Windows machine:

  • CVE-2026-85046, in Chrome's V8 JavaScript engine
  • A V8 sandbox escape that carries no CVE at all
  • CVE-2026-85880, in the Windows ALPC subsystem

The delivery is phishing with request-for-quotation lures aimed at defence organisations, linking to attacker-controlled domains that spoof US aerospace companies. Those sites serve the kit, which ultimately loads the ShadowPad backdoor.

All of that is a competent, expensive, unremarkable espionage operation. The part that is not unremarkable is who was using it.

Four groups, twelve days

First in-the-wild use is attributed to APT31, a China-aligned state-sponsored group, on 28 August 2026.

Within days, three further espionage clusters were deploying the same kit — four in total between 28 August and 3 September, the majority with a suspected China nexus.

Proofpoint's stated position on how that happened is the most interesting sentence in the research: it is currently unknown how multiple distinct threat actors obtained access to the exploit kit.

That is worth dwelling on, because it inverts the usual economics.

A working browser exploit chain is among the most expensive things in offensive security. It takes specialist labour, it is perishable — one patch and it is worthless — and its value depends on scarcity. The conventional behaviour is to hoard it: use it narrowly, against targets that justify burning it, and keep it away from anyone who might get caught and expose it.

Four separate groups running the same chain inside two weeks is the opposite of hoarding. It means either a shared supplier selling or distributing to multiple customers, a common quartermaster inside one apparatus servicing several units, or a leak that put the kit into more hands than intended.

Each of those has different implications, and nobody has established which one it is. But all three describe exploitation as a supply chain with a distribution layer, rather than as a craft practised in isolation by each group. The interesting artefact here is not the code. It is the fact that it travelled.

One link has no CVE

The middle of the chain deserves separate attention: the V8 sandbox escape has no CVE identifier.

Practically, that means there is nothing to track it by. It will not appear in a vulnerability feed, it cannot be looked up, it will not show up in a scanner's output, and an organisation cannot ask "are we affected" in the normal way. The only handle anyone has on it is the kit's name.

It also means patching status is harder to reason about than usual. Two of the three links are identified and fixable. The third is a component of a chain that a vendor may or may not have addressed, described publicly only as part of somebody else's malware analysis.

The Windows half is one we already wrote about

CVE-2026-85880 — the ALPC elevation of privilege — is not new to readers here. It is one of the two zero-days already being exploited when Microsoft shipped its record September update. We covered that Patch Tuesday, and specifically the point that the two flaws that mattered were both privilege escalation.

This is what "already being exploited" looked like in practice. The bug was in a kit, in the hands of at least four espionage groups, being fired at defence contractors, while the patch was still being written.

The general lesson is worth keeping: when a vendor marks something as exploited in the wild, that phrase is doing a lot of work. It rarely means one actor probing quietly. Increasingly it means a productised capability already in circulation.

What to do

  • Patch Chrome and the September Windows update, in that order and immediately. Two of the three links close.
  • Prioritise the ALPC fix specifically if you are staging the Windows rollout. It is the privilege escalation the chain depends on.
  • Hunt for ShadowPad, which is the payload and the most durable indicator here.
  • Look at request-for-quotation phishing against defence and aerospace suppliers. The lure is specific and the spoofed domains impersonate real US aerospace firms.
  • Do not treat a patched browser as sufficient. One link in this chain has no identifier and no confirmed fix.

What is not established

  • How four groups obtained the same kit. Proofpoint says it does not know, and speculation is not evidence.
  • Whether the V8 sandbox escape is patched. It has no CVE and no published fix status.
  • Whether the four clusters are genuinely distinct actors or overlapping units under one apparatus.
  • Victim count and success rate. Neither has been published.
  • Whether BlueMoon is sold, shared, or leaked, which is the question that determines how much more of this to expect.