4 groups caught using the same Chrome and Windows exploit kit

Proofpoint says at least four hacking groups are actively using the same exploit kit against Chromium-based browsers and older Windows releases. The researchers call it BlueMoon, and it does not rely on one weakness. It chains three vulnerabilities together so an attacker can get code running and then install malware of their choosing.

Two of the bugs are in Chromium, and the third hits the kernel in Windows 10 Oct 2018 Update, Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three have now been patched, but the timing matters: Proofpoint said the vulnerabilities were being used while fixes were only just becoming available.

The campaign also stands out for being noisy rather than careful. That is unusual. Attackers often keep newly found bugs under wraps and use them sparingly so the exploit stays useful for longer. Here, the same kit seems to have been shared widely enough that multiple groups picked it up.

Some of those groups have ties to the Chinese government, according to Proofpoint. The researchers think the broad use may have been helped by a patch gap in the Chromium supply chain, where a fix exists before it makes its way into browsers like Chrome and Edge. They also pointed to AI as another possible accelerant, since it can help spot vulnerabilities faster than humans working alone.