New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws

**BlueMoon exploit kit:** A modular exploit kit observed in active spearphishing campaigns chains two Chromium/V8 sandbox bypasses with a Windows ALPC local privilege escalation (three CVEs) to elevate Chrome renderer privileges and deploy loaders/backdoors; multiple state-aligned and other clusters (including JungleBamboo/APT31 and UTA0560) used it against NGOs, aerospace/defense suppliers, and manufacturing targets, and Proofpoint and Volexity published indicators and analysis.