Four Hacking Groups Utilize Same Exploit Kit Targeting Chromium and Windows

<p>Researchers from security firm Proofpoint reported that a nearly identical exploit kit, named BlueMoon, is actively being used by at least four hacking groups, some of which have ties to the Chinese government. The kit targets critical vulnerabilities in both Chromium-based browsers and older versions of Windows.</p><p>BlueMoon chains together three vulnerabilities, allowing attackers to install malware of their choice. It exploits two vulnerabilities in Chromium and one in the kernel of Windows 10 (Oct 2018 Update), Windows Server 2019, Windows 10 2004, Windows Server 2022, and the initial release of Windows 11. All three vulnerabilities received patches within the past 24 hours.</p><h2>Deployed Rapidly and Widely Shared</h2><p>The attacks were characterized by a lack of stealth, which is often preferred by hackers who aim to exploit newly discovered vulnerabilities sparingly to prolong their effectiveness. Proofpoint suggested that the visible and widely used exploit chain may be taking advantage of a “patch gap” in the Chromium supply chain, which refers to the time between when a patch is available from developers and when it is incorporated into browsers like Chrome and Edge. The use of AI may also contribute to the rapid identification of vulnerabilities, as it can often detect them faster than human discovery.</p>