中国官方黑客组织共享并武器化“蓝月”Chrome零日漏洞，针对美军工承包商及亚洲目标展开攻击
Chinese state espionage groups weaponize shared 'BlueMoon' Chrome zero-day against US defense and Asian targets
- 多个各自独立的中国官方背景网络间谍组织几乎同时将Chrome V8零日漏洞（代号“蓝月”）武器化，针对西方防务机构发起协同攻击。 Multiple distinct Chinese state espionage groups simultaneously weaponized a Chrome V8 zero-day ('BlueMoon') against Western defense entities.
- 同步发起的漏洞利用行动表明，中国国家情报机构在后台主导了集中式的漏洞统筹与经纪分发。 Synchronized exploitation points to centralized vulnerability brokering managed by Chinese state intelligence.
- 攻击主要通过在针对工程制造和航天航空等行业论坛布设水坑攻击实现投递。 Exploit delivered through watering-hole attacks on targeted engineering and aerospace industry forums.
据《The Record》报道，四个中国官方背景黑客团队同时部署了一套代号为“蓝月”（BlueMoon）的零日漏洞利用工具包，攻击目标包括美国国防承包商和东南亚多个政府部门。该工具将一个未修复的Chromium内存破坏缺陷与Windows内核漏洞串联，在关键的补丁空窗期绕过了企业级防护机制。
这一协同突袭源于北京2021年颁布的漏洞披露新规，该规定要求国内研究人员必须先将软件漏洞报告给国家安全部，方能与软件开发者沟通。官方机构并未利用这些漏洞协助厂商修补系统，而是推行国家级漏洞囤积，并将实施集中式漏洞武器化的工具分发给多个黑客小组，通过补丁空窗期利用，在安全补丁公开发布前最大限度攫取情报。
Four Chinese state hacking teams simultaneously deployed a zero-day exploit kit dubbed BlueMoon against American defense contractors and Southeast Asian government ministries, The Record reported. The exploit chained an unpatched Chromium memory-corruption flaw with a Windows kernel vulnerability, bypassing enterprise protections during a critical patch window.
The coordinated blitz stems from Beijing’s 2021 vulnerability disclosure law, which requires domestic researchers to report software vulnerabilities to the Ministry of State Security before sharing them with developers. Instead of facilitating vendor patches, state agencies stockpile zero-days and distribute weaponized tooling across multiple hacking units to maximize intelligence collection before security fixes become public.
哔哩哔哩与知乎上的技术圈网民纷纷赞叹中国安全研究团队挖掘零日漏洞的技术实力，但对海外情报机构利用该漏洞展开的间谍活动避而不谈。
Tech channels on Bilibili and Zhihu celebrated Chinese security researchers' zero-day discovery prowess, while downplaying foreign intelligence exploitation.
中国国内网络技术讨论受到严格控制，所有涉及该漏洞的讨论均被强制定调为纯学术研究成果，严禁提及该漏洞系通过中国国家安全部的强制性漏洞上报机制流入官方渠道。
Domestic cyber discussions are strictly required to attribute exploits to academic research, banning any mention that exploits were brokered via the Ministry of State Security's vulnerability disclosure mandate.
根据中国2021年出台的《网络产品安全漏洞管理规定》，中国公民发现的所有零日漏洞必须先向政府主管部门报告，之后才能通知软件厂商。
China's 2021 vulnerability reporting regulations require all zero-days discovered by Chinese citizens to be handed to government authorities before software vendors.