CTI · reviewed · 2026-09-11

Proofpoint identified BlueMoon, an exploit kit chaining two Chrome/V8 flaws with a Windows privilege escalation

Full story & timeline

MITRE ATT&CK

• T1189 Drive-by Compromise Initial Access
• T1203 Exploitation for Client Execution Execution
• T1059 Command and Scripting Interpreter Execution

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• cybersecurefox.com domain · active · corroborated
• 8858ea412dc306b3558885af18006c5ca24689e8875733b5e13b3c2692e603cb sha256 · active

Detections

No detection content yet — case analysis did not yield signal-specific telemetry. Check back after the next daily CTI pass.

References

• https://cyberworldops.eu/en/bluemoon-exploit-kit-gives-four-espionage-groups-a-shared-chrome-to
• https://arstechnica.com/information-technology/2026/09/4-groups-caught-using-the-same-chrome-and-windows-exploit-kit/