4 groups caught using the same Chrome and Windows exploit kit
ars ·
A security firm Proofpoint has identified an exploit kit named BlueMoon that is being used by at least four hacking groups, some tied to the Chinese government. The kit chains three vulnerabilities, two in Chromium's V8 engine and one in older Windows versions, to install malware. All three vulnerabilities were patched within 24 hours before public disclosure. Proofpoint suggests the kit's rapid and widespread use may stem from a "patch gap" in Chromium's supply chain and AI-assisted vulnerability discovery. The groups targeted a range of organizations, including US NGOs, mining and commodity trading firms, US aerospace companies, a Vietnamese manufacturer, and entities in Singapore and Indonesia. The first observed attack began on August 28, with others starting in September. Proofpoint warned that the kit could continue to spread among both espionage and financially motivated actors even after patches are fully deployed.
ars