Four Nation-State Actors Used the Same Chrome Zero-Day Exploit ...

Four nation-state actors took the same fully weaponised Chrome zero-day exploit chain for a spin within 12 days, according to a Proofpoint report, which is either a landmark in intergovernmental resource-sharing or the cyberwar equivalent of four governments splitting one Zipcar. The chain is called BlueMoon, because nothing says classified offensive capability like a name that sounds like a 2019 craft lager. It was developed, deployed and shared across multiple threat actors in under a fortnight, with the report noting a possibly reduced cost and barrier to entry for this class of capability. Somewhere a procurement officer is genuinely upset about the lack of exclusivity.

Proofpoint's tell-tales are where it gets genuinely funny: 'extensive diagnostic logging', a 'markdown handover document', and 'detailed comments documenting successive debugging iterations'. So the zero-day now ships with richer internal documentation than the payments platform at your bank. A markdown handover doc — somebody built a weapon and then wrote a README so the next tenant could redeploy it without raising a support ticket. The AI agents didn't merely write the exploit; they handled the knowledge transfer, the onboarding, the wiki. Every nation-state cyber unit that spent a decade building scarce human talent pipelines has just discovered the paperwork is now done by a model with an unusually tidy temperament.

The report's careful hedge is the best bit: the sharing 'possibly' reflects reduced cost and barrier to entry as AI agents increasingly enable threat actor exploit development. Possibly. Four state actors, one kit, 12 days — that isn't a moat eroding, that's a moat converted into a splash pad. When the hardest part of offensive cyber collapses into a prompt with a retry loop, the distinguishing asset stops being capability and becomes whoever still bothers to read the commit history. BlueMoon was named for a rare event. It is currently happening every other Tuesday.