The PolySwarm Blog

Verticals Targeted: Aerospace, Defense, Government, Financial, Manufacturing, Mining & Natural Resources, Nonprofit/NGO, Professional Services, Commodity Trading
Regions Targeted: US, Asia
Related Threat Actors: TA412 (Violet Typhoon), UNK_LateNight, UNK_DoubleCheck, UNK_QuietRacket
Related Families: BlueMoon, GemStone, ShadowPad

Executive Summary

Four espionage-focused threat actors were observed using BlueMoon, a newly tracked exploit kit chaining two Chromium V8 vulnerabilities with a Windows kernel privilege-escalation flaw. First observed in late August 2026, BlueMoon spread rapidly among mostly China-aligned clusters targeting organizations across the United States and Asia. Campaigns delivered payloads including GemStone and ShadowPad. Researchers also identified artifacts consistent with possible AI-assisted development, although evidence remains inconclusive. Proofpoint warns the kit may proliferate further as attackers increasingly exploit open-source patch gaps before downstream security updates reach users.