# MSNightmare

> As of 2026-11-11, MSNightmare is a threat actor tracked by Threadlinqs Intelligence across 3 threats spanning vulnerability. ATT&CK coverage spans 43 techniques across 12 tactics in 3 of 3 tracked threats. Most-observed techniques: T1685 (Disable or Modify Tools), T1068 (Exploitation for Privilege Escalation), T1559 (Inter-Process Communication).

- **Tracked threats:** 3
- **Categories:** VULNERABILITY
- **As of:** 2026-11-11

## ATT&CK techniques observed

43 techniques observed across 3 of 3 tracked threats. Tactics: Stealth (formerly Defense Evasion) (9), Execution (7), Discovery (5), Lateral Movement (4), Privilege Escalation (4), Command and Control (3).

- [T1685](https://intel.threadlinqs.com/technique/T1685) Disable or Modify Tools — Defense Impairment — observed in 3 of 3 tracked threats
- [T1068](https://intel.threadlinqs.com/technique/T1068) Exploitation for Privilege Escalation — Privilege Escalation — observed in 2 of 3 tracked threats
- [T1559](https://intel.threadlinqs.com/technique/T1559) Inter-Process Communication — Execution — observed in 2 of 3 tracked threats
- [T1574](https://intel.threadlinqs.com/technique/T1574) Hijack Execution Flow — Stealth (formerly Defense Evasion) — observed in 2 of 3 tracked threats
- [T1003](https://intel.threadlinqs.com/technique/T1003) OS Credential Dumping — Credential Access — observed in 1 of 3 tracked threats
- [T1003.002](https://intel.threadlinqs.com/technique/T1003.002) OS Credential Dumping — Credential Access — observed in 1 of 3 tracked threats
- [T1021](https://intel.threadlinqs.com/technique/T1021) Remote Services — Lateral Movement — observed in 1 of 3 tracked threats
- [T1021.001](https://intel.threadlinqs.com/technique/T1021.001) Remote Desktop Protocol — Lateral Movement — observed in 1 of 3 tracked threats
- [T1027](https://intel.threadlinqs.com/technique/T1027) Obfuscated Files or Information — Stealth (formerly Defense Evasion) — observed in 1 of 3 tracked threats
- [T1033](https://intel.threadlinqs.com/technique/T1033) System Owner/User Discovery — Discovery — observed in 1 of 3 tracked threats
- [T1036](https://intel.threadlinqs.com/technique/T1036) Masquerading — Stealth (formerly Defense Evasion) — observed in 1 of 3 tracked threats
- [T1036.005](https://intel.threadlinqs.com/technique/T1036.005) Match Legitimate Resource Name or Location — Stealth (formerly Defense Evasion) — observed in 1 of 3 tracked threats
- [T1053](https://intel.threadlinqs.com/technique/T1053) Scheduled Task/Job — Execution — observed in 1 of 3 tracked threats
- [T1059.003](https://intel.threadlinqs.com/technique/T1059.003) Windows Command Shell — Execution — observed in 1 of 3 tracked threats
- [T1069](https://intel.threadlinqs.com/technique/T1069) Permission Groups Discovery — Discovery — observed in 1 of 3 tracked threats

## Tracked threats

- [Windows SignDrop 0-Day: CLFS (clfs.sys) Local Privilege Escalation to SYSTEM with Public PoC (No CVE Assigned)](https://intel.threadlinqs.com/threat/TL-2026-5771) — HIGH
- [CVE-2026-50656: RoguePlanet Microsoft Defender Zero-Day Local Privilege Escalation (Malware Protection Engine TOCTOU)](https://intel.threadlinqs.com/threat/TL-2026-0835) — HIGH
- [Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)](https://intel.threadlinqs.com/threat/TL-2026-0743) — HIGH

## Related CVEs

3 CVEs referenced by tracked MSNightmare activity.

- [CVE-2026-50656](https://intel.threadlinqs.com/cve/CVE-2026-50656)
- [CVE-2026-33825](https://intel.threadlinqs.com/cve/CVE-2026-33825)
- [CVE-2025-29824](https://intel.threadlinqs.com/cve/CVE-2025-29824)

## Full data

Infrastructure, IOC values and detection queries (Splunk SPL / Microsoft KQL / Sigma) unlock per threat with TL Creds (https://threadlinqs.com/tl-creds); the Threadlinqs MCP server (Purple) serves them to AI agents: https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/actor/MSNightmare