# Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)

> RoguePlanet is a publicly released proof-of-concept exploit abusing a time-of-check-to-time-of-use (TOCTOU) race condition in Microsoft Defender's SYSTEM-level file remediation logic to spawn a SYSTEM command shell on fully patched Windows 10/11. Released on June 2026 Patch Tuesday with no CVE assigned, it is the latest in a series of seven Defender exploits from researcher 'Nightmare Eclipse', whose earlier tools (BlueHammer/CVE-2026-33825, RedSun, UnDefend) have been observed in real-world intrusions by Huntress.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0743
- **ID:** TL-2026-0743
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Nightmare Eclipse
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825

## Description

RoguePlanet is a local privilege escalation (LPE) proof-of-concept targeting Microsoft Defender Antivirus, released to a self-hosted Git repository on June 10, 2026 (Patch Tuesday) by the researcher 'Nightmare Eclipse' (aliases Chaotic Eclipse, Dead Eclipse; GitHub handle MSNightmare). The exploit abuses a race condition (TOCTOU) within Defender's internal file-processing/remediation logic. An unprivileged user redirects a file operation that Defender performs at SYSTEM privilege so that attacker-controlled code or content is written into a protected location such as C:\Windows\System32, ultimately yielding a SYSTEM-level command prompt. Because it is a race, exploitation is probabilistic: the researcher reported a 100% success rate on some fully patched machines while it failed on others. RoguePlanet was originally developed as a remote code execution primitive abusing Defender's handling of files hosted on remote SMB shares (coercing a victim to open a .vhd/.vhdx from an attacker SMB server, causing Defender to overwrite its own files); Microsoft silently hardened several Defender APIs in May 2026, blocking parts of that vector, after which the released build primarily achieves LPE. Windows 10, Windows 11 (including Canary Insider Preview), and Windows Server (believed vulnerable, current PoC non-functional) are affected. No CVE or Microsoft advisory existed as of publication.

RoguePlanet belongs to a campaign of at least seven Windows Defender exploits disclosed by Nightmare Eclipse since early April 2026, several abusing the same class of TOCTOU/oplock/NTFS-junction primitive against Defender's privileged remediation engine. The flagship, BlueHammer (CVE-2026-33825, CVSS 7.8), plants a file that triggers a Defender detection, uses a batch opportunistic lock (oplock) to pause Defender's remediation at a critical moment, then creates an NTFS junction point redirecting Defender's write target from an attacker-controlled temp directory into C:\Windows\System32; on resume Defender follows the junction and writes as SYSTEM. BlueHammer chains this to SAM database extraction and NT-hash decryption, temporarily setting user passwords to a marker value. RedSun abuses Defender's cloud-file rollback mechanism (Windows Cloud Files API placeholders + Volume Shadow Copy + oplocks + junctions) to overwrite C:\Windows\System32\TieringEngineService.exe and then trigger its execution as SYSTEM via the Storage Tiers Management COM object (CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}); it stages in %TEMP% and uses the named pipe \\.\pipe\REDSUN. UnDefend degrades Defender by watching the Definition Updates directory and locking mpavbase.vdm / mpavbase.lkg signature files (non-persistent, handle-based). Microsoft patched BlueHammer in the April 2026 Patch Tuesday (Defender Antivirus 4.18.26020.6 and earlier vulnerable; 4.18.26020.7+ fixed); CISA added CVE-2026-33825 to the KEV catalog with an FCEB remediation deadline of May 6, 2026, while RedSun and UnDefend remained unpatched.

Huntress documented a real-world intrusion using this tooling: initial access on April 15, 2026 13:44:19 UTC via a compromised FortiGate SSL VPN account from 78.29.48.29 (Russia), with follow-on sessions from 212.232.23.69 (Singapore) and 179.43.140.214 (Switzerland). Operators staged BlueHammer (FunnyApp.exe in the user's Pictures folder), RedSun.exe and UnDefend (undef.exe in short Downloads subfolders ks/kk), ran reconnaissance (whoami /priv spawned from M365Copilot.exe, cmdkey /list, net group), and deployed BeigeBurrow, a Go reverse-tunnel agent (SHA-256 a2b6c7a9c4490df70de3cdbfa5fc801a3e1cf6a872749259487e354de2876b7c) using HashiCorp yamux to beacon to staybud.dpdns.org:443 with a 5-minute reconnection loop. Operator tradecraft errors (undef.exe -h, misspelled -agressive flag) suggested a less-experienced operator reusing public tooling.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.003 Windows Command Shell
- T1559.001 Component Object Model
- T1068 Exploitation for Privilege Escalation
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1574 Hijack Execution Flow
- T1036.005 Match Legitimate Resource Name or Location
- T1070.004 File Deletion
- T1003.002 Security Account Manager
- T1555.004 Windows Credential Manager
- T1033 System Owner/User Discovery
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1573.002 Asymmetric Cryptography
- T1021.001 Remote Desktop Protocol

## Sources

- [Windows Defender 0-Day Exploit "RoguePlanet"](https://cybersecuritynews.com/windows-defender-0-day-exploit-rogueplanet/)
- [Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges](https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/)
- [Nightmare-Eclipse Tooling Seen in Real-World Intrusion](https://www.huntress.com/blog/nightmare-eclipse-intrusion)
- [BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Vulnerability Explained](https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained)
- [RedSun Zero-Day: When Defender Becomes the Delivery Mechanism](https://www.cyderes.com/howler-cell/redsun-zero-day)
- [Microsoft Defender Zero-Day "BlueHammer" Hits KEV Catalog Following Researcher's Protest](https://securityonline.info/bluehammer-exploit-cve-2026-33825-microsoft-defender-lpe/)
- [THREAT ADVISORY: RedSun Zero-Day (Windows Defender)](https://blackswan-cybersecurity.com/threat-advisory-redsun-zero-day-windows-defender-april-17-2026/)
- [Recent Microsoft Defender Vulnerability Exploited as Zero-Day](https://www.securityweek.com/recent-microsoft-defender-vulnerability-exploited-as-zero-day/)
- [MSNightmare/RoguePlanet PoC repository](https://github.com/MSNightmare/RoguePlanet)
- [CVE-2026-33825: Local Privilege Escalation via TOCTOU in Microsoft Defender (BlueHammer)](https://cvereports.com/reports/CVE-2026-33825)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0743