Researchers have uncovered a previously unknown exploit kit called BlueMoon that chains together vulnerabilities in Microsoft Windows and Google Chrome to deliver targeted espionage-grade access — and four separate threat groups were caught using it within the same week. That is not a coincidence. That is a supply chain.

The first confirmed user was APT31, a Chinese state-sponsored group with a long history of targeting government, defence, and critical infrastructure targets. APT31 — also tracked as Bronze Vinewood or Judgement Panda — is a familiar name to Australian security teams; ACSC has previously called it out for activity against Australian networks. What makes this week's finding alarming isn't APT31's involvement per se, but that three additional clusters adopted the same kit almost simultaneously.

How BlueMoon works is still being unpacked, but the core mechanic is a chained exploit: a Chrome V8 engine bug to get code running inside the browser, combined with a Windows privilege escalation flaw to break out of the browser's sandbox and into the underlying OS. Chrome independently patched an actively exploited V8 out-of-bounds write flaw (CVE-2026-87491) this week in a separate 230-vulnerability update — it's not yet confirmed whether that's the same bug in the BlueMoon chain, but the timing is suggestive.

The really uncomfortable question here is how four groups got the same kit. Three possibilities: shared development (i.e., one group built it and distributed to allies), a common black-market or grey-market broker selling exploit kits to multiple buyers, or — most unsettling — independent parallel discovery, which would suggest the underlying vulnerabilities are significantly more findable than defenders assumed.

The pace matters too. Researchers attribute AI-assisted vulnerability discovery as a likely factor in compressing the window between flaw existence and active exploitation. If that's true, the old mental model of "critical patch, 30-day remediation window" is increasingly a fiction.

For defenders, the immediate action is clear: patch Chrome now. CVE-2026-87491 has a confirmed in-the-wild exploit, and browsers are the widest attack surface in most organisations. For organisations running Windows environments (which is essentially everyone), the September Patch Tuesday fixes — as overwhelming as they are — deserve prioritisation for anything touching privilege escalation in the kernel.

The broader signal is structural. When a freshly minted exploit kit appears simultaneously in four separate campaigns, it suggests the market for offensive tooling has matured to the point where state-grade capabilities are becoming commoditised. That's the same dynamic Google's Threat Intelligence Group flagged this week in a separate report: AI is giving lesser-resourced attackers capabilities that previously required nation-state budgets.

Australian relevance: APT31 has been linked to intrusion attempts against Australian government and defence networks in prior campaigns. Any Australian organisation in the government, defence, research, or critical infrastructure sectors should treat the BlueMoon disclosure as a priority threat-hunt trigger — particularly for Chrome-based endpoints and Windows privilege escalation indicators.

Watch for: whether additional groups are identified using BlueMoon in the coming days, and whether CISA or ACSC issue specific guidance tying the kit to the CVEs patched this week.