At Least Four Chinese Espionage Groups Chain Three Zero-Days Across Chrome and Windows

Proofpoint identified at least four state-aligned Chinese threat groups exploiting a chained set of three zero-day vulnerabilities (CVE-2026-85046, CVE-2026-87491 in Chromium, CVE-2026-85880 in Windows) since August 28, with APT31 striking first and three additional groups following within days. The BlueMoon exploit chain allows attackers to escape browser sandbox and gain system privileges; activity peaked September 2-3 before Chrome patch release and continued intermittently through September 8.

The five-day patch gap between Chromium source and public Chrome release is a known friction point in the browser security model, but weaponizing it at this scale—four distinct groups, coordinated targeting across three continents, infrastructure spun up same-day—suggests either a shared exploit-as-a-service model or direct MSS coordination. The targeting of U.S. aerospace companies alongside Vietnamese manufacturing and Southeast Asian government entities indicates a broad collection priority around supply chains and regional partnerships, not a narrow espionage focus. If any aerospace firm was successfully compromised, the incident will surface in SEC filings or congressional briefings within 60 days; silence past October 10 suggests the phishing campaign failed at scale.

WHY IT MATTERS

APT31 and three additional espionage groups weaponized the vulnerability gap between Chromium's public patch (August 28) and Chrome's public release (September 3), giving them a five-day window to target a narrow pool of organizations with all three defects present—NGOs, mining firms, commodity traders, aerospace companies, and government agencies across Southeast Asia.

The exploit chain's sophistication (reverse-engineered from public Chromium patches) and the speed of secondary group adoption (within 24-48 hours) suggests either shared tooling or rapid intelligence sharing among Chinese state-sponsored operators. Watch whether Microsoft's Tuesday disclosure of CVE-2026-85880 triggers forensic investigations at targeted U.S. aerospace firms—if compromise is confirmed, attribution to MSS will force CISA to issue emergency patching guidance and likely trigger counter-intelligence reviews at defense contractors.

WHAT THIS DOESN’T TELL US

Did APT31 or the secondary groups successfully establish persistence on any U.S. aerospace or government networks, or did the phishing lures fail to convert at target organizations?

Fault Lines

Strategic intelligence, synthesized daily — with a public track record. Every call graded against what actually happened.

Front page → Get the weekly brief →