The BlueMoon exploit kit has been confirmed chaining recent Chrome and Windows zero-days, and multiple espionage-motivated threat actors have already adopted it in opportunistic deployments.
Exploit kits matter because of what they do to the attacker pool. Packaging a working zero-day chain into a reusable kit removes the need for deep technical capability - what previously required skilled operators becomes accessible to a much wider range of actors. The espionage angle here is also notable: these aren't purely financially motivated campaigns. Targeting intent is broader, and the rush to adopt suggests the kit is performing.
The practical takeaway is straightforward. Chrome and Windows patch cadence needs to be treated as non-negotiable for any organisation running managed endpoints. If your vulnerability management process has exceptions, backlogs, or user-deferred updates sitting unresolved, a chained kit like BlueMoon is exactly the kind of thing that exploits that gap. Check your exposure, and if you haven't had your internal infrastructure assessed recently, it's worth knowing what an attacker would see.