The PolySwarm Blog

Verticals Targeted: Health, Government, Telecommunications, Justice, Maritime Transportation
Regions Targeted: Guatemala, Honduras, Puerto Rico, Panama, Venezuela, Ecuador, Peru, Argentina
Related Threat Actors: FamousSparrow
Related Families: SparroWocky

Related Threat Actors: GTG-10007, Charcoal Typhoon, Salmon Typhoon, SweetSpecter, Keyhole Panda, Vixen Panda, APT41, Ravine Castle

Verticals Targeted: Aerospace, Defense, Government, Financial, Manufacturing, Mining & Natural Resources, Nonprofit/NGO, Professional Services, Commodity Trading
Regions Targeted: US, Asia
Related Threat Actors: TA412 (Violet Typhoon), UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket
Related Families: BlueMoon, GemStone, ShadowPad

Executive Summary

Four espionage-focused threat actors were observed using BlueMoon, a newly tracked exploit kit chaining two Chromium V8 vulnerabilities with a Windows kernel privilege-escalation flaw. First observed in late August 2026, BlueMoon spread rapidly among mostly China-aligned clusters targeting organizations across the United States and Asia. Campaigns delivered payloads including GemStone and ShadowPad. Researchers also identified artifacts consistent with possible AI-assisted development, although evidence remains inconclusive. Proofpoint warns the kit may proliferate further as attackers increasingly exploit open-source patch gaps before downstream security updates reach users.

Verticals Targeted: Gamers
Regions Targeted: Eastern Europe
Related Families: Chaos, Mercurial Grabber, DCRAT, NJRAT

Verticals Targeted: Finance, Enterprise, Government, Industrial
Regions Targeted: Brazil, Latin America, Spain, US
Related Threat Actors: Exilware
Related Families: AgenteV2, CNABHunter

Verticals Targeted: Fintech, Aviation, Aerospace
Regions Targeted: Middle East, Africa, Egypt, Ethiopia, Afghanistan
Related Families: NodeRabbit, PollCat

Verticals Targeted: Government, Diplomacy, Defense Manufacturing
Regions Targeted: Romania, Spain, Turkey, Europe
Related Malware: HEADLACE

Executive Summary

Russian state-sponsored threat group BlueDelta deployed the HOOKEDGE Windows backdoor in espionage campaigns targeting European diplomatic, government, and defense-related organizations. Delivered through macro-enabled Microsoft Word documents, HOOKEDGE uses scheduled tasks, Microsoft Edge, and legitimate webhook services for C2, payload staging, and data exfiltration. The campaigns demonstrate BlueDelta’s continued refinement of established tradecraft to evade detection, minimize infrastructure requirements, and selectively escalate activity against targets assessed as having higher intelligence value.

Executive Summary

SLEEPWALKER is a novel passive Windows backdoor. The malware is designed for DLL side-loading into the ESET Management Agent process ERAAgent.exe and does not autonomously beacon or contain fixed C2 infrastructure. Instead, SLEEPWALKER remains dormant until receiving a specially crafted network packet, then decrypts and executes attacker-supplied bytecode through a custom 23-instruction command language supporting scheduling, multiple communications mechanisms, staged payload delivery, lateral movement, and in-memory code execution.