BlueMoon Chains Three Zero-Days Across Five China-Linked Actors in Nine Days

Proofpoint telemetry shows Violet Typhoon targeting US NGOs and commodity traders on August 28, followed within five days by UNK_LateNight against aerospace firms, UNK_DoubleCheck in Vietnam manufacturing, and UNK_QuietRacket hitting Indonesian and Singaporean government and finance. All variants share identical V8 sandbox escape, ALPC escalation, and Chrome broker injection routines. Packaging differences appear limited to obfuscation layers, indicating rapid sharing rather than independent development.

Development artifacts recovered by Proofpoint contain repetitive code patterns and incomplete error handling consistent with AI-assisted generation, though no single file proves the claim. The kit's low integration cost allowed five distinct espionage groups to field it before Microsoft and Google patches shipped on September 3 and September 8. This timeline contradicts prior assumptions that zero-day chains require months of exclusive actor use.

Operational pattern indicates lowered barriers: once one group weaponized the three flaws, diffusion occurred through shared infrastructure or purchase. Expect financially motivated actors to adopt BlueMoon-derived loaders by late September, shifting from espionage-only use. Continuous V8 and ALPC monitoring remains the immediate defensive requirement.

Next observable signal will be BlueMoon variants appearing in crimeware affiliate programs or reused in North Korean tooling, testable against public malware repositories within 45 days.