Four hacking groups caught sharing one Chrome-Windows exploit kit

Four separate threat groups got caught running the exact same exploit kit against Chrome and Windows, according to an Ars Technica report published September 9. The groups have no known connection to each other, yet each one deployed identical code.

That breaks a basic assumption security teams have relied on for years. An exploit chain used to work like a fingerprint: spot it in the wild and you had a decent shot at tracing it to one actor or one leaked toolkit. Four unrelated groups running the same chain means that shortcut no longer holds, so investigators have to verify origin from scratch every time instead of pattern-matching to a known source.

The report points to two likely drivers behind that shift: a widening patch gap and the falling cost of finding vulnerabilities with AI-assisted tooling. The timing sharpens it. The same outlet had just covered Microsoft shipping a record 972 patches in a single release. That volume doesn't just mean more fixes went out. It means more windows stayed open somewhere in the interval before every affected machine updated, and a chain that works against both Chrome and Windows only needs one of those windows to survive long enough for four groups to find and reuse it.

What the report doesn't nail down is the mechanism. Did the groups find the same weakness independently, or did the chain leak from one to the others? That distinction changes what a defender should watch for, and it's still open.

If discovery keeps getting this cheap, the fingerprint model breaks down further. Watch whether attribution reporting starts hedging more often. That's the tell that consolidation is becoming the norm instead of the exception.