{
 "Event": {
  "uuid": "7c4fd82c-a984-5d50-abdc-b98dedbb7e04",
  "info": "Four nation-state actors deploy shared BlueMoon Chrome and Windows zero-day exploit kit within twelve days",
  "date": "2026-08-28",
  "threat_level_id": "1",
  "analysis": "2",
  "distribution": "3",
  "published": false,
  "Orgc": {
   "name": "SecurityStudies.info"
  },
  "Tag": [
   {
    "name": "tlp:clear"
   },
   {
    "name": "securitystudies:status=\"curated\""
   },
   {
    "name": "securitystudies:type=\"apt\""
   },
   {
    "name": "misp-galaxy:threat-actor=\"APT31\""
   },
   {
    "name": "misp-galaxy:country=\"united states\""
   },
   {
    "name": "misp-galaxy:country=\"vietnam\""
   },
   {
    "name": "misp-galaxy:country=\"indonesia\""
   },
   {
    "name": "misp-galaxy:country=\"singapore\""
   },
   {
    "name": "misp-galaxy:sector=\"Government\""
   },
   {
    "name": "misp-galaxy:sector=\"Non-Governmental Organisations\""
   },
   {
    "name": "misp-galaxy:sector=\"Financial Services\""
   },
   {
    "name": "misp-galaxy:sector=\"Manufacturing\""
   },
   {
    "name": "misp-galaxy:sector=\"Mining and Commodities\""
   },
   {
    "name": "misp-galaxy:sector=\"Consulting\""
   }
  ],
  "Attribute": [
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securitystudies.info/cyber/incidents/four-nation-state-actors-deploy-shared-bluemoon-chrome-and-windows-zero-day-exploit-kit-within-twelve-days/",
    "comment": "SecurityStudies.info entry",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://securityaffairs.com/198783/apt/four-nation-state-actors-used-the-same-chrome-zero-day-exploit-kit-within-12-days.html",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.cisa.gov/news-events/alerts/2026/09/04/cisa-adds-one-known-exploited-vulnerability-catalog",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "link",
    "category": "External analysis",
    "value": "https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog",
    "comment": "source",
    "to_ids": false
   },
   {
    "type": "text",
    "category": "Other",
    "value": "TA412 (APT31) and three suspected China-aligned clusters tracked as UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket independently deployed the same exploit chain combining Chrome V8 type confusion CVE-2026-85046, an unnamed V8 sandbox escape and Windows kernel privilege escalation CVE-2026-85880. TA412 activity began on 28 August 2026 against US NGOs, mining companies and commodity traders; the other clusters followed from 2 September, hitting Vietnamese manufacturing and then Indonesian and Singaporean government, consulting and financial entities. The Chromium patch had been public since 7 August but Chrome stable only shipped on 3 September, giving the actors a wide exploitation window. The convergence on one kit points to a shared exploit broker or quartermaster.",
    "comment": "summary",
    "to_ids": false
   }
  ]
 }
}