Four groups caught using the same Chrome and Windows exploit kit

Proofpoint researchers uncovered an active exploit kit called "BlueMoon" that chains two Chromium flaws and a Windows kernel vulnerability to deliver arbitrary malware; it was rapidly weaponized and shared among at least four threat groups (some with reported ties to the Chinese government), exploiting a Chromium supply-chain patch gap before downstream browsers incorporated fixes, and all three flaws received patches within 24 hours.