Threadlinqs IntelligenceStart free

Threat actorTracked since 2026-06

MSNightmare

As of 2026-11-11, MSNightmare is a threat actor tracked by Threadlinqs Intelligence across 3 threats spanning vulnerability. ATT&CK coverage spans 43 techniques across 12 tactics in 3 of 3 tracked threats. Most-observed techniques: T1685 (Disable or Modify Tools), T1068 (Exploitation for Privilege Escalation), T1559 (Inter-Process Communication).

Tracked threats
33 high
First seen
2026-06-10
Last seen
2026-11-11
ATT&CK techniques
43across 3 of 3 threats
Related CVEs
3Referenced by its activity
3 tracked threat(s) · Categories: VULNERABILITY

Activity timeline

MSNightmare appears in 3 tracked threats between and ; the busiest month was 2026-06 with 2 reports.

ATT&CK techniques observed

43 techniques observed across 3 of 3 tracked threats · Stealth (formerly Defense Evasion) (9), Execution (7), Discovery (5), Lateral Movement (4), Privilege Escalation (4), Command and Control (3)
  • T1685 Disable or Modify Tools — Defense Impairmentobserved in 3 of 3 tracked threats
  • T1068 Exploitation for Privilege Escalation — Privilege Escalationobserved in 2 of 3 tracked threats
  • T1559 Inter-Process Communication — Executionobserved in 2 of 3 tracked threats
  • T1574 Hijack Execution Flow — Stealth (formerly Defense Evasion)observed in 2 of 3 tracked threats
  • T1003 OS Credential Dumping — Credential Accessobserved in 1 of 3 tracked threats
  • T1003.002 OS Credential Dumping — Credential Accessobserved in 1 of 3 tracked threats
  • T1021 Remote Services — Lateral Movementobserved in 1 of 3 tracked threats
  • T1021.001 Remote Desktop Protocol — Lateral Movementobserved in 1 of 3 tracked threats
  • T1027 Obfuscated Files or Information — Stealth (formerly Defense Evasion)observed in 1 of 3 tracked threats
  • T1033 System Owner/User Discovery — Discoveryobserved in 1 of 3 tracked threats
  • T1036 Masquerading — Stealth (formerly Defense Evasion)observed in 1 of 3 tracked threats
  • T1036.005 Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion)observed in 1 of 3 tracked threats
  • T1053 Scheduled Task/Job — Executionobserved in 1 of 3 tracked threats
  • T1059.003 Windows Command Shell — Executionobserved in 1 of 3 tracked threats
  • T1069 Permission Groups Discovery — Discoveryobserved in 1 of 3 tracked threats

Tracked threats

Related CVEs

3 CVEs referenced by tracked MSNightmare activity