New 'BlueMoon' kit exploited Windows and Chrome zero-day flaws

The BlueMoon exploit kit demonstrates how state-sponsored threat actors weaponize zero-day vulnerabilities in widely-used software — specifically Chrome's V8 JavaScript engine and a Windows kernel privilege escalation flaw — to achieve full system compromise via a single chained attack. Because these were zero-days, no patch existed at the time of exploitation, making proactive vulnerability management and defence-in-depth controls critical compensating measures. High-value targets such as NGOs are particularly at risk as they often lack the security maturity to detect sophisticated, multi-stage exploits. This incident underscores that relying solely on patching is insufficient; organisations must layer detection, least-privilege access, and browser hardening to reduce their attack surface before patches are available.