Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
TLP:WHITE43 IOCs
BlueMoon Exploit Kit Rapidly Targets Key Verticals Across Multiple Espionage Campaigns
Threat Actors
Malware Families
Diamond Model
Adversary(36)
Infrastructure
Capability(41)
Victim
Indicators of Compromise
Indicators of Compromise43
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2026-85046 aptespionageexploit | High | 78 | Sep 4, 26 |
| CVE | CVE-2023-1389 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360 file-hashintel-blogloader | High | 85 | Sep 9, 26 |
| CVE | CVE-2025-49704 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141 exploitfile-hashintel-blog | High | 85 | Sep 9, 26 |
| CVE | CVE-2022-30190 exploitintel-blogloader | High | 77 | Jun 12, 26 |
| SHA256 | 353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee file-hashintel-blogloader | High | 85 | Sep 9, 26 |
| CVE | CVE-2025-0994 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d apt31bluemoonbronze vinewood | Medium | 55 | Sep 9, 26 |
| CVE | CVE-2022-47986 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7 exploitfile-hashintel-blog | High | 85 | Sep 9, 26 |
| SHA256 | 3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726 apt31bluemoonbronze vinewood | Medium | 55 | Sep 9, 26 |
| CVE | CVE-2025-55182 aptespionageexploit | High | 80 | Jun 2, 26 |
| SHA256 | 87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22 botnetfile-hashintel-blog | High | 85 | Sep 9, 26 |
| CVE | CVE-2021-3493 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | 295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915 exploitfile-hashintel-blog | High | 85 | Sep 9, 26 |
| CVE | CVE-2023-34362 aptespionageexploit | High | 78 | Sep 3, 26 |
| CVE | CVE-2025-3248 botnetddosexploit | High | 79 | Jun 29, 26 |
| CVE | CVE-2025-53770 exploitintel-blogloader | High | 79 | Jun 12, 26 |
| CVE | CVE-2026-85880 aptespionageexploit | High | 75 | Sep 9, 26 |
| CVE | CVE-2022-31199 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| SHA256 | e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004 file-hashintel-blogloader | High | 85 | Sep 9, 26 |
| CVE | CVE-2021-21974 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| SHA256 | 7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288 exploitfile-hashintel-blog | High | 85 | Sep 9, 26 |
| CVE | CVE-2022-21894 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-49706 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-46604 exploitintel-blogloader | High | 78 | Aug 27, 26 |
| CVE | CVE-2021-4034 exploitintel-blogloader | High | 78 | Jun 2, 26 |
| SHA256 | 3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432 file-hashintel-blogloader | High | 85 | Sep 9, 26 |
| CVE | CVE-2022-26134 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-2868 exploitintel-blogloader | High | 77 | Jun 2, 26 |
| CVE | CVE-2024-3400 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2023-22518 aptespionageexploit | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-21412 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2026-87491 aptespionageexploit | High | 71 | Sep 10, 26 |
| CVE | CVE-2021-33044 exploitintel-blogloader | High | 78 | Jul 30, 26 |
| CVE | CVE-2026-21509 aptespionageexploit | High | 79 | Jun 2, 26 |
| CVE | CVE-2017-7921 exploitintel-blogloader | High | 77 | Jun 3, 26 |
| CVE | CVE-2024-7344 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2023-36025 exploitintel-blogloader | High | 77 | Oct 9, 26 |
| CVE | CVE-2025-53771 exploitintel-blogloader | High | 81 | Oct 9, 26 |
| CVE | CVE-2024-40766 exploitintel-blogloader | High | 79 | Sep 9, 26 |
| CVE | CVE-2025-21042 exploitintel-blogloader | High | 77 | Oct 9, 26 |
IOC Relationship Graph
IOC Relationship Graph43 total IOCs
CVESHA256