kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · CN

APT31

also tracked as ta412 1, unk doublecheck 1, unk latenight 1, unk quietracket 1

1 story · 1 in the wild · September 10, 2026 – September 10, 2026

evidence: 1 observed

sectors

  • energy 1 · Sep 10
  • finance 1 · Sep 10
  • government 1 · Sep 10
  • nonprofit 1 · Sep 10
  • technology 1 · Sep 10

geography

  • indonesia 1 · Sep 10
  • singapore 1 · Sep 10
  • southeast asia 1 · Sep 10
  • united states 1 · Sep 10
  • vietnam 1 · Sep 10

techniques

  • privilege escalation 1 · Sep 10
  • sandbox escape 1 · Sep 10
  • type confusion 1 · Sep 10

attack phases seen

  • Execution 1 · Sep 10
  • Initial access 1 · Sep 10
  • Privilege escalation 1 · Sep 10

what we reported, newest first, grouped by story

Sep 5 – September 10, 2026

  • BlueMoon, a previously undocumented exploit kit, chains a V8 type-confusion bug (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880) present only in older Windows builds. Both V8 bugs were "patch-gap" zero-days: the fix for CVE-2026-85046 was committed upstream on 7 August but did not reach stable Chromium until 3 September. First use was TA412 (APT31 / Violet Typhoon) on 28 August against US NGOs, mining companies and commodity trading firms; UNK_LateNight hit US aerospace from 2 September, UNK_DoubleCheck a Vietnamese manufacturer via a compromised Southeast Asian government mailbox, and UNK_QuietRacket government, consulting and financial targets in Indonesia and Singapore from 3 September. Identical orchestration and loading across samples points to one builder; how multiple actors obtained it is unknown (Proofpoint, The Record). · Sep 10 · observed · as ta412, unk latenight, unk doublecheck, unk quietracket · Exploited in the Wild