🕵️ TA412

The items that name it 2

• [tl;dr sec] #347 - AI Agents Hacking Companies for $25, Threat Hunter's Guide to GitHub, Finding Gadgets Like it’s 2026
  article2026-09-24It is written here as TA412: first actor to use BlueMoon, hit US NGOs and installed GemStone.

  first actor to use BlueMoon, hit US NGOs and installed GemStone

• Once in a BlueMoon: Multiple State-Aligned Threat Actors Rapidly Adopt Novel Chrome/Windows Zero-Day Chain
  writeup2026-09-09It is written here as TA412 (JungleBamboo, Violet Typhoon, APT31, TIDE CASTLE).

  China-aligned state-sponsored threat actor, first observed using BlueMoon exploit kit on 28 August 2026, targeting US NGOs, mining companies, and physical commodity trading firms. Previously indicted by US government in 2024 for economic espionage, transnational oppression, and foreign intelligence