OTX Threat: Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days

Four espionage-motivated threat actors have been observed deploying the BlueMoon exploit kit, which chains Chrome browser and Microsoft Windows vulnerabilities. The initial adopter was China-aligned TA412 on 28 August 2026, followed by several other suspected China-nexus groups within days. The exploit chain targets CVE-2026-85046 (Chromium V8 type-confusion), a V8 sandbox escape, and CVE-2026-858 CVEs: CVE-2026-85046, CVE-2026-85880 Sectors: Aerospace, Government, NGO