Four Spy Groups Used the Same Chrome and Windows Exploit Kit Within a Week

Multiple espionage-motivated threat activity clusters have been found deploying a previously undocumented exploit kit called BlueMoon that chains together multiple vulnerabilities in Microsoft Windows and Google Chrome. The first in-the-wild use of BlueMoon has been attributed to the China-aligned state-sponsored group tracked as APT31 (aka Bronze Vinewood, Judgement Panda, JungleBamboo,

Report facts: The article describes a previously undocumented exploit kit named BlueMoon that chains multiple vulnerabilities in Microsoft Windows and Google Chrome, and was rapidly adopted by at least four espionage-focused threat groups, including the China-aligned APT31. This indicates a sophisticated, reusable exploitation capability targeting widely deployed software components. RealGround analysis: For AI-enabled organizations, such platform-level exploit kits pose an AI supply chain risk because compromise of browsers and OS hosts can undermine the integrity of AI tools, agents, and data they process, even if the AI systems themselves are not directly targeted. Hardening the broader software stack that supports AI workloads, continuously red-teaming endpoints used to access AI agents, and maintaining detailed SBOMs for critical AI infrastructure are practical steps to reduce the blast radius of similar exploit-kit campaigns.