Rescana (rescana.com), publié le 23 septembre 2026. L'article est une alerte d'exploitation active basée sur des observations de terrain par des firmes de threat intelligence, dont Volexity. En septembre 2026, au moins deux groupes APT d'origine chinoise — UTA0560 et JungleBamboo (alias APT31, Violet Typhoon, TA412) — ont mené une campagne coordonnée d'espionnage cyber.

UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.

China-linked UTA0560 and JungleBamboo targeted NGOs with a three-vulnerability zero-day chain across Chrome and Windows between August and September 2026. The Chromium patch gap — the delay between a fix landing in open-source code and reaching Chrome stable — created a window of exposure that threa

A spear-phishing link to a real .edu site used reflected XSS to bounce NGO staff into a three-bug Chrome and Windows zero-day chain ending in the GRIMWEDGE backdoor. No attachment, no macro, one click. #infosec #cybersecurity

UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.

A Chinese threat actor tracked as UTA0560 used spear-phishing and a Chrome-Windows exploit chain to deliver the GRIMWEDGE JavaScript backdoor to NGOs. Around the same time, JungleBamboo (APT31) used the same chain to deploy SUPERSTOMP and the LONGTALE credential-stealing Chrome extension. #UTA0560 #GRIMWEDGE #JungleBamboo #APT31 #LONGTALE #SUPERSTOMP #Chrome #Windows #BlueMoon...

UTA0560 exploited a Chrome-Windows zero-day chain against NGOs to deploy GRIMWEDGE; APT31 used the same chain to install LONGTALE.

BlueMoon is a newly observed exploit kit that multiple espionage groups rapidly adopted to chain Chrome zero-days and a Windows privilege escalation flaw in rushed, opportunistic attacks. Proofpoint says it was first used by Violet Typhoon and then shared across other threat actors targeting organizations in the US, Vietnam, Indonesia, and...

複数のサイバースパイグループが、BlueMoonと呼ばれる新種のエクスプロイトキットを使用していることが、サイバーセキュリティ企業Proofpointの報告で明らかになりました。展開の様子は場当たり的かつ急ごしらえに見えるということです。 中国と関係が深いAPTグループ「Violet Typhoon」（APT31、J

Google Chromeおよびウィンドウズカーネルの新たに公表された脆弱性チェーンにより、標的を侵害し、スパイ活動用マルウェアを展開し、ブラウザの認証情報を盗み出すことが可能になっています。 Volexityによると、UTA0560とJungleBamboo(APT31、Violet Typhoon、TA412とし

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

Multiple cyber-espionage groups used the BlueMoon exploit kit to chain zero-day flaws in Microsoft Windows and Google Chrome for remote code execution, sandbox escape, and privilege escalation. Proofpoint and Volexity linked distinct BlueMoon campaigns to JungleBamboo, UTA0560, UNK_LateNight, and UNK_DoubleCheck, with targets including NGOs, U.S. aerospace and defense firms, and Vietnamese manufacturers. #BlueMoon #JungleBamboo #APT31 #VioletTyphoon #UTA0560 #UNK_LateNight #UNK_DoubleCheck #Chrome #MicrosoftWindows

BlueMoon chains two Chrome V8 zero-days with a Windows flaw in phishing attacks used by APT31 and other espionage clusters.

BlueMoon is a newly observed exploit kit used in espionage campaigns to chain Chrome and Windows vulnerabilities for code execution, sandbox escape, and privilege escalation. Proofpoint linked the first in-the-wild use to APT31 and said the kit quickly spread to other China-aligned clusters while leaving behind persistence mechanisms such as malicious...

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

Proofpoint found at least four China-aligned threat groups chaining three zero-day flaws in Chrome, Chromium-based browsers, and Windows to carry out espionage since late August. The BlueMoon exploit chain has been used against NGOs, mining and commodity firms, U.S. aerospace companies, and organizations in Vietnam, Indonesia, and Singapore. #TA412 #VioletTyphoon #APT31 #BlueMoon #CVE-2026-85046 #CVE-2026-87491 #CVE-2026-85880 #UNK_LateNight #UNK_DoubleCheck #UNK_QuietRacket

BlueMoon chains two Chrome V8 zero-days with a Windows flaw in phishing attacks used by APT31 and other espionage clusters.

Proofpoint says four state-aligned clusters adopted the BlueMoon exploit chain within a week.

Sinds eind augustus 2026 is een nieuwe exploitkit genaamd BlueMoon actief, ingezet door minstens vier dreigingsgroepen die waarschijnlijk gelieerd zijn aan China. De eerste geregistreerde inzet vond plaats op 28 augustus 2026 door de groep TA412, ook bekend als Violet Typhoon of APT31. TA412 voerde spearphishing-aanvallen uit gericht op Amerikaanse non-profitorganisaties, mijnbouwbedrijven en grondstoffenhandelaren. Het doel was de installatie van een kwaadaardige browser-extensie genaamd GemStone. Deze extensie biedt backdoortoegang voor browserbewaking, inclusief keylogging, diefstal van cookies, het maken van screenshots en het onderscheppen van HTTP-verzoeken. BlueMoon maakt gebrui...

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

В ежегодном отчёте атаки из Москвы называют «малоизощрёнными» и «банальными».