Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
Windows Defender 0-Day Local Privilege Escalation (TL-2026-0743), also tracked as RoguePlanet, is a high-severity software vulnerability, first published 2026-06-10. It is attributed to Nightmare Eclipse with medium confidence, affects Microsoft Microsoft Defender Antivirus, maps to 19 MITRE ATT&CK techniques (T1003.002, T1021.001, T1033), and is covered by 9 detection rules and 25 indicators of compromise.
Key facts for TL-2026-0743
- Threat ID
- TL-2026-0743
- Also known as
- RoguePlanet, Nightmare Eclipse Defender Exploit Series
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-06-10
- Last reviewed
- 2026-06-10
- Attribution
- Nightmare Eclipse
- Attribution confidence
- MEDIUM
- Motivation
- HACKTIVISM
- Target sectors
- technology, managed-services, enterprise
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 25
Malware and tooling in Windows Defender 0-Day Local Privilege Escalation
Malware and tooling: BeigeBurrow, Exploit:Win32/DfndrPEBluHmr.BZ, BlueHammer, RoguePlanet, UnDefend, yamux reverse tunnel (HashiCorp DefaultConfig)
RoguePlanet is a publicly released proof-of-concept exploit abusing a time-of-check-to-time-of-use (TOCTOU) race condition in Microsoft Defender's SYSTEM-level file remediation logic to spawn a SYSTEM command shell on fully patched Windows 10/11. Released on June 2026 Patch Tuesday with no CVE assigned, it is the latest in a series of seven Defender exploits from researcher 'Nightmare Eclipse', whose earlier tools (BlueHammer/CVE-2026-33825, RedSun, UnDefend) have been observed in real-world intrusions by Huntress.
How Windows Defender 0-Day Local Privilege Escalation works
RoguePlanet is a local privilege escalation (LPE) proof-of-concept targeting Microsoft Defender Antivirus, released to a self-hosted Git repository on June 10, 2026 (Patch Tuesday) by the researcher 'Nightmare Eclipse' (aliases Chaotic Eclipse, Dead Eclipse; GitHub handle MSNightmare). The exploit abuses a race condition (TOCTOU) within Defender's internal file-processing/remediation logic. An unprivileged user redirects a file operation that Defender performs at SYSTEM privilege so that attacker-controlled code or content is written into a protected location such as C:\Windows\System32, ultimately yielding a SYSTEM-level command prompt. Because it is a race, exploitation is probabilistic: the researcher reported a 100% success rate on some fully patched machines while it failed on others. RoguePlanet was originally developed as a remote code execution primitive abusing Defender's handling of files hosted on remote SMB shares (coercing a victim to open a .vhd/.vhdx from an attacker SMB server, causing Defender to overwrite its own files); Microsoft silently hardened several Defender APIs in May 2026, blocking parts of that vector, after which the released build primarily achieves LPE. Windows 10, Windows 11 (including Canary Insider Preview), and Windows Server (believed vulnerable, current PoC non-functional) are affected. No CVE or Microsoft advisory existed as of publication.
RoguePlanet belongs to a campaign of at least seven Windows Defender exploits disclosed by Nightmare Eclipse since early April 2026, several abusing the same class of TOCTOU/oplock/NTFS-junction primitive against Defender's privileged remediation engine. The flagship, BlueHammer (CVE-2026-33825, CVSS 7.8), plants a file that triggers a Defender detection, uses a batch opportunistic lock (oplock) to pause Defender's remediation at a critical moment, then creates an NTFS junction point redirecting Defender's write target from an attacker-controlled temp directory into C:\Windows\System32; on resume Defender follows the junction and writes as SYSTEM. BlueHammer chains this to SAM database extraction and NT-hash decryption, temporarily setting user passwords to a marker value. RedSun abuses Defender's cloud-file rollback mechanism (Windows Cloud Files API placeholders + Volume Shadow Copy + oplocks + junctions) to overwrite C:\Windows\System32\TieringEngineService.exe and then trigger its execution as SYSTEM via the Storage Tiers Management COM object (CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}); it stages in %TEMP% and uses the named pipe \\.\pipe\REDSUN. UnDefend degrades Defender by watching the Definition Updates directory and locking mpavbase.vdm / mpavbase.lkg signature files (non-persistent, handle-based). Microsoft patched BlueHammer in the April 2026 Patch Tuesday (Defender Antivirus 4.18.26020.6 and earlier vulnerable; 4.18.26020.7+ fixed); CISA added CVE-2026-33825 to the KEV catalog with an FCEB remediation deadline of May 6, 2026, while RedSun and UnDefend remained unpatched.
Huntress documented a real-world intrusion using this tooling: initial access on April 15, 2026 13:44:19 UTC via a compromised FortiGate SSL VPN account from 78.29.48.29 (Russia), with follow-on sessions from 212.232.23.69 (Singapore) and 179.43.140.214 (Switzerland). Operators staged BlueHammer (FunnyApp.exe in the user's Pictures folder), RedSun.exe and UnDefend (undef.exe in short Downloads subfolders ks/kk), ran reconnaissance (whoami /priv spawned from M365Copilot.exe, cmdkey /list, net group), and deployed BeigeBurrow, a Go reverse-tunnel agent (SHA-256 a2b6c7a9c4490df70de3cdbfa5fc801a3e1cf6a872749259487e354de2876b7c) using HashiCorp yamux to beacon to staybud.dpdns.org:443 with a 5-minute reconnection loop. Operator tradecraft errors (undef.exe -h, misspelled -agressive flag) suggested a less-experienced operator reusing public tooling.
MITRE ATT&CK techniques used in TL-2026-0743
Credential Access
T1003.002 Security Account Manager; T1555.004 Windows Credential Manager
Lateral Movement
T1021.001 Remote Desktop Protocol
Discovery
T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1087 Account Discovery
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1574 Hijack Execution Flow
Execution
T1059.003 Windows Command Shell; T1559.001 Component Object Model
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548.002 Bypass User Account Control
Command and Control
T1071.001 Web Protocols; T1572 Protocol Tunneling; T1573.002 Asymmetric Cryptography
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
defense-impairment
Affected products and versions in Windows Defender 0-Day Local Privilege Escalation
- Microsoft — Microsoft Defender Antivirus
Vulnerable versions: 4.18.26020.6 and earlier (BlueHammer/CVE-2026-33825); current platform as of June 2026 (RoguePlanet, unpatched)
Fixed in: 4.18.26020.7 (CVE-2026-33825 only) - Microsoft — Windows 10
Vulnerable versions: fully patched, June 2026 - Microsoft — Windows 11
Vulnerable versions: fully patched, June 2026; Canary Insider Preview - Microsoft — Windows Server
Vulnerable versions: 2016; 2019; 2022; 2025 (believed vulnerable; current RoguePlanet PoC non-functional)
Remediation for Windows Defender 0-Day Local Privilege Escalation
Patches
- Microsoft Defender Antivirus 4.18.26020.7+ (April 2026 Patch Tuesday) for CVE-2026-33825/BlueHammer.
- No Microsoft patch available for RoguePlanet, RedSun, or UnDefend as of June 10, 2026.
Immediate actions
- Ensure Microsoft Defender Antivirus platform is updated to 4.18.26020.7 or later (April 2026 cumulative update) to close CVE-2026-33825/BlueHammer; treat RoguePlanet/RedSun/UnDefend as unpatched and rely on behavioral detection.
- Hunt for SYSTEM-level writes into C:\Windows\System32 that originate from user-writable paths such as %TEMP%, Pictures, and short Downloads subfolders.
- Block the documented C2 (staybud.dpdns.org) and source IPs 78.29.48.29, 212.232.23.69, 179.43.140.214 at the perimeter.
- Audit FortiGate SSL VPN accounts for anomalous logins and enforce MFA; rotate credentials for any account authenticating from multiple geographies in a short window.
Workarounds
- Restrict ability to create NTFS junctions/mount points where feasible.
- Enforce Attack Surface Reduction rules and tamper protection on Defender.
- Monitor for VSS enumeration (NtQueryDirectoryObject targeting HarddiskVolumeShadowCopy*) and CfRegisterSyncRoot calls from non-cloud-sync software.
Longer-term hardening
- Deploy EDR with behavioral detection for oplock + NTFS junction abuse and Defender remediation redirection.
- Monitor Defender Definition Updates directory for unexpected file locking (UnDefend behavior).
- Alert on Storage Tiers Management COM activation (CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}) and overwrites of TieringEngineService.exe from non-administrative sessions.
- Network segmentation to limit lateral movement and reverse-tunnel C2 egress on 443.
Weaknesses (CWE) in Windows Defender 0-Day Local Privilege Escalation
CWE-367, CWE-362, CWE-59
Timeline of Windows Defender 0-Day Local Privilege Escalation
- BlueHammer Defender LPE PoC publicly released by Nightmare Eclipse in protest over MSRC disclosure handling.
- BlueHammer publicly disclosed; tracked as CVE-2026-33825 (TOCTOU race in Defender remediation, CVSS 7.8).
- In a real-world intrusion, BlueHammer variant FunnyApp.exe executed and quarantined from the victim's Pictures folder (Huntress).
- Microsoft patched CVE-2026-33825 in April 2026 Patch Tuesday (Defender Antivirus 4.18.26020.7+).
- Initial access at 13:44:19 UTC via compromised FortiGate SSL VPN account from 78.29.48.29 (Russia).
- RedSun.exe and UnDefend (undef.exe) executed from short Downloads subfolders; BeigeBurrow reverse tunnel deployed.
- RedSun zero-day threat advisory published; RedSun and UnDefend remain unpatched.
- CISA KEV FCEB remediation deadline for CVE-2026-33825/BlueHammer.
- Microsoft silently hardened several Defender APIs in May 2026, blocking RoguePlanet's original SMB-based RCE vector.
- RoguePlanet LPE PoC released on Patch Tuesday to a self-hosted Git repository; no CVE or Microsoft advisory as of publication.
Sources cited for Windows Defender 0-Day Local Privilege Escalation
- Windows Defender 0-Day Exploit "RoguePlanet"
- Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges
- Nightmare-Eclipse Tooling Seen in Real-World Intrusion
- BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Vulnerability Explained
- RedSun Zero-Day: When Defender Becomes the Delivery Mechanism
- Microsoft Defender Zero-Day "BlueHammer" Hits KEV Catalog Following Researcher's Protest
- THREAT ADVISORY: RedSun Zero-Day (Windows Defender)
- Recent Microsoft Defender Vulnerability Exploited as Zero-Day
- MSNightmare/RoguePlanet PoC repository
- CVE-2026-33825: Local Privilege Escalation via TOCTOU in Microsoft Defender (BlueHammer)
Threats related to Windows Defender 0-Day Local Privilege Escalation
- NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions
- LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)
- RoguePlanet: Microsoft Defender Elevation of Privilege Vulnerability (CVE-2026-50656) Patched
- FalconFlank: Unpatched Local Privilege Escalation PoC in CrowdStrike Falcon Sensor via Office Macro Remediation
- LegacyHive: Unpatched Windows User Profile Service (profsvc) Registry Hive Hijack Privilege Escalation 0-Day PoC Released by Nightmare-Eclipse
- LegacyHive: Local Privilege Escalation PoC via Windows User Profile Service (ProfSvc) Registry Hive Mounting
Detection coverage for TL-2026-0743
As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0743 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.