Cyber intelligence · 4 October 2026
The same kit, four groups
From 28 August, Proofpoint saw the same kit in the hands of at least four groups. The question is not who wrote it.
By Rafael Núñez Aponte. Published on 4 October 2026.
Original text in Spanish. Read the original Spanish version
What is striking is not that a flaw exists. It is that the same package changes hands in a few days.
From 28 August, Proofpoint watched a kit and gave it a name: BlueMoon. Ars Technica summed up the finding on 9 September. At least four groups, some with links to the Chinese government, were using an almost identical chain.
What it does, short
Two flaws in Chrome’s V8 engine. Then CVE-2026-85880, to raise privileges on Windows that is no longer yesterday’s: old Windows 10 builds, Server 2019, the first Windows 11. SecurityWeek described it without epic. The kit leaves the browser sandbox, looks at the machine, then fires the escalation. The deployments they saw were opportunistic and rushed.
Part of the reported use was targeted email. Other coverage, also drawing on Proofpoint, speaks of non-governmental organisations. The fine signature is not closed on a single name. A board does not need that name in order to decide.
The question that does belong to leadership
Cyber intelligence that does not change a decision on Thursday is a folder. This kit changes one. The company browser is not an employee matter. It is a door. And the old Windows in finance is not an aesthetic debt. It is the third step of the package.
What to ask on Monday
- Which Windows builds in the executive team and in finance does this kit still understand?
- Who reads a report like this on Wednesday and moves something on Thursday?
- Is the browser on the inventory with a version and a date, or under a we have Chrome?
- Does the intelligence you buy have an owner in the room, or only in the contract?
References
- BlueMoon exploit kit chains recent Chrome and Windows zero-days. SecurityWeek. Accessed: 2026-10-04. Proofpoint vio despliegues oportunistas y hechos a prisa. El kit escapa del aislamiento del navegador, identifica el equipo y entonces dispara la escalada de privilegios.
- Four groups caught using the same Chrome and Windows exploit kit. Ars Technica. Accessed: 2026-10-04. Al menos cuatro grupos, algunos con vínculos con el gobierno chino, usaron una cadena casi idéntica contra Chrome y versiones viejas de Windows. El relato es de Proofpoint, no una atribución cerrada por el autor.