Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

TLP:WHITE88 IOCs

Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Exploit Chain Using Chrome and Windows Zero-Days

Proofpoint Threat Insight

Published September 9, 2026Original Report

Threat Actors

Malware Families

Diamond Model

Adversary(3)

Infrastructure(6)

Capability(3)

Victim

Indicators of Compromise

Indicators of Compromise88

Type	Indicator	Confidence	Score	First Seen
SHA256	ff1b49aaec994f4c11f2c9331e739abb4bc3d6abf66ec50ce99709fba35d782b apt31bluemoonbronze vinewood	Medium	43	Sep 9, 26
URL	https://download.secboxes.com:443/dist.zip intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	8453c42904b7b2fea5671b7bff06b2d937632ae29545fd11bc13095627a2805f apt31bluemoonbronze vinewood	Medium	46	Sep 9, 26
Domain	asianstudies.secboxes.com exploitintel-blogmalware	High	58	Oct 9, 26
Domain	rocketlabusa.ink exploitintel-blogmalware	High	58	Oct 9, 26
Domain	emcore.ink exploitintel-blogmalware	High	58	Oct 9, 26
Domain	dns.elixnovorem.com apt31bluemoonbronze vinewood	Medium	63	Sep 9, 26
URL	https://app.eduac.workers.dev/Service intel-blogmalwarenetwork	Low	32	Sep 9, 26
Domain	brianwilli.com exploitintel-blogmalware	High	58	Oct 9, 26
CVE	CVE-2026-85046 aptespionageexploit	High	78	Sep 4, 26
Domain	fracons.com aptespionageintel-blog	High	58	Oct 9, 26
SHA256	bc7d24f5cf8937b334966201bdcce8ca9bab6ec5889d40a399d4094dcad73360 file-hashintel-blogloader	High	85	Sep 9, 26
URL	https://homepage.brianwilli.com/d/calibre-launcher.dll apt31bluemoonbrowser-extension	High	63	Sep 9, 26
Domain	getaiexo.com c2intel-blogloader	High	58	Oct 9, 26
URL	https://zki0y83.msbenefit.com:443/feed intel-blogmalwarenetwork	High	58	Oct 9, 26
URL	https://homepage.brianwilli.com/d/wint.exe intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	elixnovorem.com intel-blogloadermalware	High	58	Oct 9, 26
Domain	cyclokinetics.online exploitintel-blogmalware	High	58	Oct 9, 26
URL	https://api-prod.secboxes.com:443/download intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	bosch-sensortec.site exploitintel-blogmalware	High	58	Oct 9, 26
IP	79.133.56.90 exploitintel-blogmalware	High	58	Oct 9, 26
URL	https://evidence.msbenefit.com/msgbox.exe intel-blogmalwarenetwork	High	58	Oct 9, 26
URL	https://homepage.brianwilli.com/d/SysPr.prx intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	vncdc.mailtbox.workers.dev exploitindicatorintel-blog	Low	32	Sep 9, 26
SHA256	ac6806c89e294f390838cb07c015dabec1c8ada06ce5161a0ad50b8a72828141 exploitfile-hashintel-blog	High	85	Sep 9, 26
Domain	epsilonsystems.net exploitintel-blogmalware	High	58	Oct 9, 26
Domain	dns.velodynaity.com intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	lindes.ink exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	ac6bbc4b1f1c62e308781329183a46e18f454c27e66bffa09f343b53ac622b69 apt31bluemoonbronze vinewood	Medium	43	Sep 9, 26
URL	https://small-union-7018.daoahueb.workers.dev/ botnetintel-blogmalware	High	86	Sep 10, 26
SHA256	353b5bd2780c1b0c07c1283d83cf16cf1e9ec226c17b2d09d56848893f9d98ee file-hashintel-blogloader	High	85	Sep 9, 26
Domain	secboxes.com intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	publish.openlumakora.com apt31bluemoonbronze vinewood	Medium	63	Sep 9, 26
SHA256	a4a6a04d85eca8d584d939d2437c85a4f291207d8042f2ec002838e336b72ef5 apt31bluemoonbronze vinewood	Medium	43	Sep 9, 26
Domain	airliquide.lol exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	6e6378d8d404166da89d982e80bc52e19a3f677201258dec1775f100a027a92d apt31bluemoonbronze vinewood	Medium	55	Sep 9, 26
Domain	mailtbox.workers.dev exploitindicatorintel-blog	Low	32	Sep 9, 26
Domain	openlumakora.com exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	f3c64014221a58f3fde88e562662dbd5a1b3dd2b59c86e9e2bc5cb8f671664e7 exploitfile-hashintel-blog	High	85	Sep 9, 26
SHA256	3594ad58fb6217fafe9839e53999a90608c2e9f335fa20aece3d53f8c0802726 apt31bluemoonbronze vinewood	Medium	55	Sep 9, 26
URL	https://snowy-block-ae0a.daoahueb.workers.dev/ intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	extension-management-portal.kmjukilo-lkjh.workers.dev intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	apollohospitals.fit exploitintel-blogmalware	High	58	Oct 9, 26
URL	https://app.eduac.workers.dev/Updateac intel-blogmalwarenetwork	High	86	Sep 10, 26
Domain	spectrolab.fit exploitintel-blogmalware	High	58	Oct 9, 26
Domain	yhv41nji.workers.dev exploitindicatorintel-blog	Low	32	Sep 9, 26
URL	https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/SysPr.prx exploitintel-blogmalware	Low	32	Sep 9, 26
Domain	smxtech.xyz exploitintel-blogmalware	High	58	Oct 9, 26
Domain	dns.getaiexo.com bluemoonbrowser-extensionc2	Medium	63	Sep 9, 26
SHA256	87b6b24c06f99900a8aa579caedee1e402015884c925a98dcfb0fb38dfa2de22 botnetfile-hashintel-blog	High	85	Sep 9, 26
Domain	sncorp.fit exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	295fc584f75e94108c9be945977db33ed80421f5d374eab188587c911dffd915 exploitfile-hashintel-blog	High	85	Sep 9, 26
Domain	data.attcdn.com exploitintel-blogmalware	High	58	Oct 9, 26
URL	https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.dll intel-blogmalwarenetwork	Low	32	Sep 9, 26
Domain	ms.checrity.com c2intel-blogmalware	High	58	Oct 9, 26
CVE	CVE-2026-85880 aptespionageexploit	High	75	Sep 9, 26
Domain	velodynaity.com intel-blogmalwarenetwork	High	58	Oct 9, 26
URL	https://1a062f4982564d6d19a76884ce8bcbb6.r2.cloudflarestorage.com/datago/krita.exe intel-blogmalwarenetwork	Low	32	Sep 9, 26
SHA256	e950d03c58d49e28e31df8afeefca1f3b3d2cd6b697c40adfee1a4f6fe18f004 file-hashintel-blogloader	High	85	Sep 9, 26
URL	https://homepage.brianwilli.com/d/85rY.dat intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	royal-surf-a2e2.daoahueb.workers.dev intel-blogloadermalware	High	58	Oct 9, 26
Domain	haloengines.net exploitintel-blogmalware	High	58	Oct 9, 26
Domain	extension-management-portal.centerfjdr658.workers.dev intel-blogmalwarenetwork	High	58	Oct 9, 26
SHA256	7d6f6dcb17a423bdd7715f8a4e34f2939501a761bc9bf7aa005f805ef1f82288 exploitfile-hashintel-blog	High	85	Sep 9, 26
URL	https://recommendation-letter.secboxes.com/ChromeUpdate.exe exploitintel-blogmalware	High	58	Oct 9, 26
Domain	eduac.workers.dev exploitintel-blogmalware	High	58	Oct 9, 26
Domain	jetoptera.co exploitintel-blogmalware	High	58	Oct 9, 26
Domain	black-flower-9250.v93xdd5g.workers.dev c2exploitintel-blog	High	58	Oct 9, 26
Domain	joinmacket.com exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	b34802a646fc4a8f07ffa09a5fda8bf7327446b22e3d7bb5163dafa1e2a8bb2b apt31bluemoonbronze vinewood	Medium	46	Sep 9, 26
Domain	wcce.joinmacket.com exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	779b3e1a470e589d492b99154ba11622fbaebb19b3de694f660c725411b7096d apt31bluemoonbronze vinewood	Medium	43	Sep 9, 26
Domain	precipart.ink exploitintel-blogmalware	High	58	Oct 9, 26
Domain	daoahueb.workers.dev intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	airindia.fit exploitintel-blogmalware	High	58	Oct 9, 26
Domain	attcdn.com exploitintel-blogmalware	High	58	Oct 9, 26
SHA256	3ec3151d8d1278ed966941ac89ea495ef6a80c70613dd9138cc85fc28c9df432 file-hashintel-blogloader	High	85	Sep 9, 26
Domain	msbenefit.com exploitintel-blogmalware	High	64	Oct 9, 26
Domain	airproducts.ink exploitintel-blogmalware	High	58	Oct 9, 26
URL	https://homepage.brianwilli.com/d/ intel-blogmalwarenetwork	High	58	Oct 9, 26
Domain	tcomlp.online exploitintel-blogmalware	High	58	Oct 9, 26
Domain	silvustechnologies.online exploitintel-blogmalware	High	58	Oct 9, 26
Domain	v93xdd5g.workers.dev c2exploitindicator	Low	33	Sep 9, 26
Domain	worldview.fit exploitintel-blogmalware	High	58	Oct 9, 26
CVE	CVE-2026-87491 aptespionageexploit	High	71	Sep 10, 26
Domain	aurexdefense.online exploitintel-blogmalware	High	58	Oct 9, 26
Domain	checrity.com c2intel-blogmalware	High	58	Oct 9, 26
URL	https://project.secboxes.com/ChromeUpdate.exe exploitintel-blogmalware	High	58	Oct 9, 26

IOC Relationship Graph

IOC Relationship Graph88 total IOCs

SHA256URLDomainCVEIP

scroll to zoom · drag to pan · click IOC to open