BlueMoon used in espionage campaigns, the latest developments on the APT front, global cybercrime activity and operations targeting Italy

BlueMoon: 0-day exploit kit rapidly adopted in espionage campaigns

Between late August and early September 2026, BlueMoon, a new exploit kit used by espionage-focused groups in targeted spear phishing campaigns, was observed. Its first known use dates back to August 28, when the Chinese state-sponsored group APT31 used it against a limited number of NGOs, mining companies and U.S. commodity trading firms. In the following days, BlueMoon was also adopted by UTA0560, UNK_LateNight, UNK_DoubleCheck and UNK_QuietRacket. Most of the observed groups have suspected links to China, but some uses remain unattributed and additional adversaries may also be using the same exploit kit. BlueMoon chains three vulnerabilities. The first, CVE-2026-85046 (CVSS 8.8), is a Type Confusion vulnerability in Chromium’s V8 JavaScript engine that enables code execution in the renderer. The second, CVE-2026-87491 (CVSS 8.8), is a sandbox escape vulnerability in V8 classified as an Out-of-bounds Write. Finally, the third, CVE-2026-85880 (CVSS 7.8), is a Privilege Escalation vulnerability in the Windows kernel affecting older builds and used to escape the renderer process and obtain elevated privileges. Once the chain is completed, BlueMoon allows execution of an attacker-chosen command followed by deployment of the payload on the compromised system. The two V8 vulnerabilities were patch-gap 0-days: fixes were already publicly available in Chromium’s upstream source code but had not yet been distributed in stable versions of Chrome and other Chromium-based browsers. It is considered likely that the BlueMoon developer used these public patches to rapidly turn the vulnerabilities into a working exploit chain. The campaigns distributed different payloads. Since at least August 28, APT31 has targeted a limited number of NGOs, mining companies and U.S. commodity trading firms. The Beijing-linked APT used a loader called SUPERSTOMP to install GemStone (LONGTALE), a malicious Chromium browser extension disguised as Google Gemini and designed to collect cookies, storage data, keystrokes, browsing information and screenshots. Starting on September 1, 2026, UTA0560 was observed in operations against several NGOs, where it deployed a loader chain culminating in GRIMWEDGE, an in-memory JScript backdoor with reconnaissance, file and process management, command execution and additional payload loading capabilities. From September 2, UNK_LateNight targeted U.S. aerospace companies with B2B lures and requests for quotation related to the defense industrial base, distributing ShadowPad. During the same period, UNK_DoubleCheck targeted a Vietnamese manufacturing company through a compromised Southeast Asian government account, while from September 3, UNK_QuietRacket, suspected of being aligned with China, targeted government, financial and consulting organizations in Indonesia and Singapore. It is not known how the different groups obtained access to BlueMoon. Given the ease with which it was adopted, further diffusion among both espionage-oriented and financially motivated adversaries is considered likely while patched versions continue to be rolled out across Chromium-based browsers. Google fixed CVE-2026-85046 and CVE-2026-87491 on September 3 and September 8 respectively, while Microsoft patched CVE-2026-85880 on September 8.

APT: new developments involving North Korea, Pakistan, China and Türkiye

Two South Korean organizations in the automotive and media sectors were targeted in a campaign focused on long-term surveillance and espionage that leveraged a Linux toolkit mainly composed of a backdoor called Ted, a curl-based RAT named curlRAT, a stager and an SSH keylogger, as well as trojanized versions of crond, agetty, atd, sshd and polkitd. Part of the C2 infrastructure had already been associated with ScarCruft, but the available evidence does not allow the campaign to be conclusively attributed to a specific North Korean group. ScarCruft also conducted the Operation GitPower campaign, targeting personnel at banks, insurance companies and businesses in South Korea and designed to ensure persistent access to victims’ computers. In some phishing PDFs, the Creator and Producer fields contain the string opencode, linked to the AI agent of the same name. Finally, a recent analysis of North Korea’s cyber capabilities confirms a complex apparatus that is an integral part of the state’s strategy and is used for intelligence activities, sanctions evasion and revenue generation, while also providing previously undisclosed insights. Moving to Pakistan, Barmanou conducted a campaign against Indian government, Defense and diplomatic targets aimed at achieving persistent control and data theft through the deployment of the Crimson RAT and a custom RAT. Turning to China, the espionage group UNC3569 exploited CVE-2026-51990 in Sogou Input Method to distribute a C++ backdoor called GRAYRABBIT through a one-click compromise chain. The chain also exploits CVE-2021-38003 in the embedded Chromium engine to achieve code execution and load the final payload into memory. The exploit enables execution of shellcode that downloads a legitimate 7z.exe, a trojanized DLL and an encrypted payload containing GRAYRABBIT, the final payload in the chain. Lastly, Apple sent notifications to the iPhones of at least three Turkish ministers warning them that they may have been targeted with mercenary spyware. According to statements made to local media by a Turkish official, authorities in Ankara believe the compromise attempts failed, but Türkiye’s recently established Cybersecurity Presidency examined the phones, replaced them and introduced additional security measures. It is unclear which tool was used. In 2021, senior Turkish officials had already allegedly been targeted with the spyware Pegasus from Israeli company NSO Group.

Cybercrime: global cyber campaigns, as well as phishing and ransomware activity targeting Italy

A financially motivated group called Toy Ghouls (Bearlyfy, Laboo.boo, Feral Wolf) targeted Russian organizations using a proprietary ransomware named GenieLocker and, since early July 2026, a custom backdoor tracked in two different variants, HiveMQ and Element. An adversary known as BREEZE COMET (alias UNC5669) has been observed since 2024 targeting Brazilian financial services, retail and e-commerce organizations using custom backdoors, remote management tools and tunneling malware, with the aim of manipulating banking software and payment systems to perform illicit transfers on behalf of entities already authorized to operate on the Rede Nacional do Setor Financeiro. In April 2026, security researchers observed a presumably Russian attacker called UAT-10820 conducting an operation aimed at stealing credentials and cryptocurrency data through the deployment of Amatera Stealer. Moving to Italy, phishing campaigns were tracked with the following characteristics: SMS messages used an alleged failed BRT delivery as a pretext and invited recipients to access a link in the message to reschedule the shipment, with the aim of collecting personal data and payment information; an email themed around the Italian Business Register invited recipients to update personal and company details through a link in the message leading to a website designed to exfiltrate personal information and banking details. On the ransomware front, The Gentlemen claimed the compromise of Abaco Viaggi S.r.l., a tour operator operating in Friuli Venezia Giulia and Veneto; while SAFEPAY claimed Gruppo Assiprime (Assiprime 2020 S.r.l.), an insurance and financial services company headquartered in Piacenza and specializing in tailored insurance policies and consulting services for businesses and private individuals.

Weekly Threats Report is Telsy’s weekly update featuring the main developments on cyber attacks and threat actors worldwide, produced by our Threat Intelligence & Response team.

The team is composed of analysts and security researchers with technical and investigative skills and internationally recognized experience.

Through continuous monitoring of cyber threats and geopolitical events, it produces and provides organizations with useful information to anticipate attacks and understand their scope, with the support of a trusted partner in the event of a cyber incident.

Learn more about our Cyber Threat Intelligence solution.