Chinese state-linked hackers exploit Chrome vulnerability

Coverage from The Record indicates that at least four cyber-espionage groups, primarily linked to Chinese state intelligence, have been actively exploiting a previously unknown Google Chrome vulnerability since late August. These groups utilized the same exploit kit, identified as BlueMoon by cybersecurity firm Proofpoint, to compromise Chrome browsers.

The BlueMoon exploit kit targeted U.S. defense contractors, NGOs, and Southeast Asian government agencies. The exploit leveraged two browser flaws and a Windows vulnerability, allowing attackers to gain control of a victim's computer. The vulnerability exploited a four-week patch gap between when a fix was available in the open-source Chromium project and when it reached stable Chrome users. This allowed attackers to reverse-engineer the fix and create an exploit. While the attackers operated as separate groups with distinct malware and infrastructure, the shared exploit kit raises questions about whether they are supplied by the Chinese government, a common contractor, or if the tools are available on a commercial market.

One of the groups, TA412 (also known as APT31), targeted U.S. NGOs and commodity traders, deploying a malicious browser extension. Another group, UNK_LateNight, targeted U.S. aerospace and defense companies. A third, UNK_DoubleCheck, targeted a Vietnamese manufacturer. The fourth, UNK_QuietRacket, targeted organizations in Indonesia and Singapore. Evidence suggests artificial intelligence may have aided in the development of the BlueMoon exploit kit, potentially accelerating the process of weaponizing patches.

Source: The Record