BlueMoon Exploit Chain — UTA0560 & JungleBamboo

Two distinct Chinese threat actors — UTA0560 and JungleBamboo (aka APT31 / Violet Typhoon / TA412) — independently weaponized the same three-CVE, byte-for-byte-identical exploit chain against different targets starting 2026-09-01, publicly reported by Volexity on 2026-09-09 and separately tracked by Proofpoint as "BlueMoon". The chain opens with spear-phishing links that abuse a reflected XSS on a legitimate US university website to redirect to actor infrastructure, then chains CVE-2026-85046 (Chrome V8 type confusion → arbitrary R/W in the V8 sandbox), CVE-2026-87491 (WebAssembly defect → V8 sandbox escape), and CVE-2026-85880 (Windows kernel LPE, Volexity attributes to RtlpCreateServerAcl) to inject code into the Chrome browser process and spawn cmd.exe via CreateProcessA — full code execution outside the browser sandbox, with no patched Chrome release available at the time of the campaign (an unusual "patch-gap" 0-day: fixed in the Chromium source, not yet in a shipped Chrome build).

Post-exploitation diverges by actor. UTA0560 downloads msgbox.exe, a dropper that sideloads wsc.dll, which persists via a scheduled task named "Windows Scheduled System" (re-runs every 5 minutes), beacons per-host to cloud[.]shinewrist[.]net, and pulls an MSI executed via msiexec.exe that installs the GRIMWEDGE JScript backdoor (10-command in-memory backdoor, C2 at ocr[.]opusaccel[.]top). JungleBamboo downloads its own msgbox.exe (the SUPERSTOMP loader), which tampers with Chrome's Secure Preferences file — stripping encrypted_hash/super_encrypted_hash integrity values and forging a legacy HMAC — to force-install a malicious extension, LONGTALE (ID ckiknalbeplpcpofpnabcnhjcegckfei), masquerading as "Google Gemini" and exfiltrating keystrokes, form data, cookies/session tokens, and keyword-triggered screenshots roughly every 30 seconds.

All three CVEs are now in the CISA Known Exploited Vulnerabilities catalog (added 2026-09-04, 2026-09-08, and 2026-09-09 respectively). Endpoint telemetry cannot observe the in-browser V8/kernel exploitation itself — the defensible surface is entirely post-exploitation behavior.

Research mode: Campaign / Actor (Volexity blog as primary source, corroborated with CISA KEV and press). All sources below were fetched and saved verbatim to BlueMoon-JungleBamboo-UTA0560-Hunt-sources/ for the provenance gate.

Analyst notes / contradictions carried into §9 (Gaps)

• Phishing URL discrepancy: Volexity's own narrative text names the first JungleBamboo phishing link as hxxps://photos.msbenefit[.]com/fb/w3z ("unavailable" at analysis time), but its own IOC appendix lists hxxps://photos.msbenefit[.]com/fa/t3 as the Sept 1 phishing URL for the same domain. Not reconciled within the source. This pack ships the IOC-appendix value (fa/t3) as the canonical indicator.
• CVE-2026-85880 technical framing disagreement: Volexity (T1, campaign-specific) attributes the kernel LPE to a defect in RtlpCreateServerAcl; Proofpoint's reporting (via BleepingComputer/IT-Connect, T2) frames it as "a heap-based buffer overflow in Windows ALPC"; CISA's KEV entry titles it "Microsoft Windows Heap-Based Buffer Overflow Vulnerability" without naming the function. These are very likely the same defect described at different technical granularity (RtlpCreateServerAcl sits in ALPC-adjacent security-descriptor code), but it is not confirmed as identical across sources — this pack cites Volexity's function-level detail as primary.
• Affected Windows Server scope: Volexity's own build list is Win10 1809–22H2, Server 2022, Win11 21H2 only. IT-Connect (citing Proofpoint) additionally names Windows Server 2019 — not confirmed against the Volexity primary text or an independently fetched Proofpoint source; flagged as unconfirmed rather than dropped.
• Broader actor scope: CyberInsider references a third/fourth payload family (ShadowPad) used by other clusters exploiting the same chain, and search results referenced "four cyberespionage groups" in total (from a Proofpoint report not independently fetched/saved for this pack). This pack's detections are scoped to the two actors named in the task (UTA0560, JungleBamboo) — additional actors using the same exploit chain are a known out-of-scope gap.
• CISA KEV remediation due dates: the saved KEV bulletin text confirms catalog addition dates but does not itself state the per-CVE FCEB remediation deadline — that lives on the live KEV catalog page, not the alert bulletin. This pack does not cite specific due dates that aren't present in a saved snapshot; consult the live catalog for exact deadlines.

Non-CQL checks that extend coverage beyond Falcon EDR telemetry.

• Windows Task Scheduler operational log (Microsoft-Windows-TaskScheduler/Operational, Event ID 106/140) or Security 4698 (if scheduled-task auditing is enabled) — filter Task Name = "Windows Scheduled System". Complements Q4 on hosts where Falcon coverage gaps exist.
• Security 4688 (process creation, if command-line auditing is enabled) — filter parent image = chrome.exe, new process = cmd.exe. Complements Q2 for non-Falcon-covered segments.
• Chrome policy/extension audit — on suspect hosts, check chrome://extensions and chrome://policy for extension ID ckiknalbeplpcpofpnabcnhjcegckfei or any extension named "Google Gemini" that is not the vendor-verified one.
• Secure Preferences manual integrity check — compare %LocalAppData%\Google\Chrome\User Data\Default\Secure Preferences against a known-good baseline; a JSON parse that shows missing per-preference encrypted_hash entries or a missing super_encrypted_hash is the direct artifact of SUPERSTOMP tampering.
• Mail gateway / M365 message trace — search for sender ircribbin77@hotmail[.]com ("Irma Cribbin") and links to photos.msbenefit[.]com, proof.gitprogram[.]com, or any *.gitprogram[.]com / *.msbenefit[.]com URL. Volexity notes both actors dual-target work and personal addresses in the same message — flag messages sent to both.
• Passive DNS / DNS resolver logs for unmanaged or BYOD devices outside Falcon coverage — query for cloud[.]shinewrist[.]net, ocr.opusaccel.top, gitprogram.com, msbenefit.com resolutions.
• If your organization operates a public-facing site with reflected-XSS exposure — review web server access/error logs for the redirect-abuse pattern; this campaign shows attackers will opportunistically weaponize a trusted third-party domain's XSS to build a credible-looking phishing chain.

Four queries are promoted to Custom IOA candidates — distinctive, portable, actor-behavior patterns rather than volatile infrastructure. Remaining queries (Q1, Q3, Q5, Q6, Q7, Q10) stay Investigate-only / IOC-Management entries: they key on domains, IPs, or hashes that rotate or expire faster than an IOA pattern should.

IOA-1 · Chrome → cmd.exe unexpected child process HIGH PRIORITY

Detects: Q2 pattern. Deployment path: after the 14-day benign-baseline period (§11), promote to a Custom IOA rule scoped to ImageFileName=chrome.exe → child FileName=cmd.exe. Exclusions: Chrome internal helper CommandLine containing --type=; any approved RMM/automation tool identified during baselining. Alert framing: [CRITICAL] Detection: BlueMoon — Chrome spawned cmd.exe (possible sandbox-escape code exec).

IOA-2 · "Windows Scheduled System" task creation

Detects: Q4 pattern. Deployment path: deploy directly as a Custom IOA (no baseline period needed — the task name is not observed in any legitimate baseline). Exclusions: none identified. Alert framing: [CRITICAL] Detection: BlueMoon/UTA0560 — "Windows Scheduled System" persistence task created.

IOA-3 · Chrome Secure Preferences tampering

Detects: Q8 pattern. Deployment path: requires Playbook C (Critical File Monitoring rule) deployed first; run in audit/monitor mode for 14 days before promoting to alerting. Exclusions: writer process = chrome.exe (already excluded in the query itself); add any Chrome profile-migration/enterprise-management tool identified during baselining. Alert framing: [CRITICAL] Detection: BlueMoon/JungleBamboo — non-Chrome process modified Secure Preferences.

IOA-4 · LONGTALE extension ID artifact

Detects: Q9 pattern. Deployment path: deploy directly as a Custom IOA (unique identifier, no baseline needed). Exclusions: none identified. Alert framing: [HIGH] Detection: BlueMoon/JungleBamboo — LONGTALE malicious extension artifact observed.

Investigate-only queries — hunt description & pivots

• Q1 / Q5 / Q7 (network/C2): hunt weekly against current infra list; pivot to Q2/Q4/Q8/Q9 hits on the same aid within ±1 hour for corroboration. Refresh domain/IP list as infra rotates.
• Q3 / Q10 (hash-based): feed the same hash set into Falcon IOC Management (§10 grab-csv) for prevention coverage in addition to hunting — hash IOCs are better served by IOC Management than a pattern-based IOA.
• Q6 (msiexec/Temp.txt): investigate-only pending a wider FP baseline; pivot to check whether the same aid shows a Q4 or Q5 hit in the preceding 24 hours before escalating.

Playbook A — Chrome ExtensionInstallBlocklist / Allowlist enforcement

Prerequisites: Administrator rights on the target host (or GPO edit rights + Chrome ADMX/ADML templates loaded in the domain Central Store for fleet deployment). Reboot required: No — Chrome re-reads policy on next relaunch, or within ~90 minutes automatically; force immediately with gpupdate /force then relaunch Chrome. Rollback: delete the two registry keys below (or unlink/disable the GPO); Chrome reverts to unmanaged extension-install behavior with no data loss.

# Chrome ExtensionInstallBlocklist / Allowlist — PowerShell (per-host) or push via GPO Preferences
# Prerequisites: Run as Administrator
# Reboot required: No (relaunch Chrome, or run gpupdate /force for domain-pushed policy)
# Rollback: Remove-Item the two keys below to restore unmanaged extension install behavior

New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist" `
  -Name "1" -Value "*" -PropertyType String -Force | Out-Null

New-Item -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" -Force | Out-Null
New-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist" `
  -Name "1" -Value "REPLACE_WITH_APPROVED_EXTENSION_ID" -PropertyType String -Force | Out-Null

# Verify
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallBlocklist"
Get-ItemProperty "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallAllowlist"

Playbook B — CVE-2026-85880 patch-compliance verification

Prerequisites: Get-HotFix / CIM read access on the target host (run locally, via remote PS session, or an EDR RTR script). Reboot required: No for this check script — the underlying Windows cumulative update itself requires a reboot to take effect; deploy the CU through normal patch management and use this script only to verify it is already installed. Rollback: none required — read-only verification script.

# CVE-2026-85880 patch-compliance check — PowerShell
# Prerequisites: Get-HotFix / CIM access on target host
# Reboot required: No for this CHECK script (the CU itself needs a reboot -- deploy
#   it via normal patch management; this script only verifies it is installed)
# Rollback: none required (read-only)

# REPLACE_WITH_KB_ID: the September 2026 cumulative-update KB article number for
# CVE-2026-85880, from your patch console / the Microsoft Security Update Guide
# entry for CVE-2026-85880 -- left as a placeholder because the exact KB number
# was not confirmed against a saved source snapshot for this pack.
$RequiredKB = "REPLACE_WITH_KB_ID"

$os = Get-CimInstance Win32_OperatingSystem
Write-Host "Host: $env:COMPUTERNAME  OS: $($os.Caption)  Build: $($os.Version)"

if (Get-HotFix -Id $RequiredKB -ErrorAction SilentlyContinue) {
    Write-Host "COMPLIANT -- $RequiredKB is installed"
} else {
    Write-Host "NOT COMPLIANT -- $RequiredKB not found; verify against your patch console and remediate CVE-2026-85880"
}

Playbook C — Falcon Critical File Monitoring on Chrome Secure Preferences

Prerequisites: Falcon console admin rights; Endpoint Security / Custom IOA / File Integrity Monitoring feature enabled for the target host groups. Reboot required: No. Rollback: disable or delete the custom file-monitoring rule; no endpoint-side change to undo.

Falcon console steps (no script -- console-configured rule):
1. Endpoint Security -> Custom IOA Rule Groups (Windows)
2. New Rule Group -> File System rule
3. Path pattern: *\Google\Chrome\User Data\*\Secure Preferences
4. Action: Monitor / Detect -- start in AUDIT mode, not Prevent
5. Assign to a pilot host group first
6. Validate against Q8 (Section 8) for 14 days before promoting fleet-wide
7. Rollback: delete the rule group -- no endpoint state changes to revert

All Detection Validation Gates from §11 apply before promoting any Investigate-only query to alerting. The four named GAPs above are structural (unobservable at the endpoint or requiring non-EDR tooling) rather than missing queries — they are the honest limit of what Falcon EDR alone can cover for this threat.

All seven sources above were fetched in full and saved verbatim to BlueMoon-JungleBamboo-UTA0560-Hunt-sources/ alongside this pack for the provenance-check gate.