# LegacyHive: Windows 0-Day Allows Standard Users to Load Another User's Registry Hive via User Profile Service

> Security researcher Nightmare-Eclipse (GitHub: MSNightmare), a self-identified grudge actor known as 'Chaotic Eclipse'/'Dead Eclipse' who has released six Windows zero-days since April 2026, publicly disclosed LegacyHive: an unpatched local elevation-of-privilege primitive that lets a standard user mount another user's registry hive under their own HKCU classes root by abusing the Windows User Profile Service. No CVE, Microsoft advisory, or patch currently exists; the public PoC is intentionally crippled to require a second standard user's credentials plus a third (potentially administrator) username.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-07-15T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1351
- **ID:** TL-2026-1351
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Nightmare Eclipse
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825

## Description

LegacyHive is a proof-of-concept elevation-of-privilege primitive targeting the Windows User Profile Service (ProfSvc), the component responsible for loading and unloading a signed-in user's registry hives (NTUSER.DAT and UsrClass.dat) at logon/logoff. The published technique allows a low-privileged, standard (non-administrator) local user to cause a hive belonging to a different local user account to be mounted underneath the attacker's own HKEY_CURRENT_USER\Software\Classes root, i.e., their per-user 'classes root'. Once mounted there, the victim's hive data — including UsrClass.dat contents such as COM/shell-extension registrations, file-association state, and other shell configuration — becomes readable/writable in a context the attacker fully controls, without the attacker ever needing SYSTEM or Administrator privileges to trigger the load.

The vulnerability class is not novel in kind: Microsoft has previously shipped at least three related fixes for User Profile Service / registry-hive-loading elevation-of-privilege bugs — MS15-003 (ProfSvc could be tricked, via a Shell Folders registry key change plus an NTFS junction, into opening an arbitrary UsrClass.dat belonging to another user), MS16-111 (RegLoadAppKey / NtLoadKeyEx hive-attachment-point abuse), and MS16-124 (NtLoadKeyEx read-only-hive-to-write-mode fallback with process impersonation leading to EoP). LegacyHive appears to be a modern recurrence of the same underlying pattern in current, fully-patched Windows builds, indicating the User Profile Service's hive-load path has not been durably hardened against this class of abuse.

The researcher, operating under the handles Nightmare-Eclipse, 'Chaotic Eclipse', and 'Dead Eclipse' (blog: deadeclipse666.blogspot.com), announced ahead of time that a 'major exploit targeting Microsoft products' would land on 2026-07-14, having previously claimed unspecified 'chains' were preventing an earlier release. On that date the LegacyHive GitHub repository (github.com/MSNightmare/LegacyHive, mirrored at git.projectnightcrawler.dev/NightmareEclipse/LegacyHive, MIT-licensed, C++) appeared, initially as a placeholder ('N/A' README, license file only, 2 commits), with full source (LegacyHive.cpp) and documentation following roughly 11 hours later (4 commits total). The researcher deliberately stripped the released PoC down from its original, more dangerous form: the internal/original version could reportedly load an arbitrary registry hive with no extra credentials, while the public build is artificially restricted to the UsrClass.dat hive only and requires the operator to already possess a second standard user's password plus the username of a third account (which can be an administrator account) before the primitive will fire. This restriction is a self-imposed abuse-reduction measure by the discloser, not a mitigation implemented by Microsoft.

LegacyHive is the latest in a six-exploit campaign by the same actor since April 2026, all targeting Microsoft Windows: BlueHammer (CVE-2026-33825, a TOCTOU race in Windows Defender's file-remediation engine using an NTFS junction to redirect a Defender write to C:\Windows\System32 for SYSTEM code execution — patched 2026-04-14, added to CISA KEV 2026-04-22/23, and confirmed by CISA on 2026-06-30 to be under active exploitation by ransomware gangs), RedSun (an alternate Defender privilege-escalation path to SYSTEM, silently patched, no CVE assigned), UnDefend (a Defender-disruption tool that weakens detection while masking reported system health), YellowKey (a BitLocker bypass affecting TPM-only configurations, exploitable with physical device access), GreenPlasma (a partial Windows LPE PoC released as a building block rather than a complete exploit), and MiniPlasma (an LPE tied to a supposedly-already-fixed 2020-era vulnerability, confirmed by researchers to still work on fully patched Windows 11 as of May 2026). The actor has publicly stated a grievance-driven motive ('someone violated our agreement and left me homeless with nothing'), alleged direct threats from MSRC personnel, and has promised further RCE disclosures plus a 'dead man's switch' for automatic exploit release; Huntress Labs linked April 2026 exploitation activity to Russian-geolocated infrastructure, and some evidence (demonstrated insider-level Windows codebase knowledge) has fueled speculation of a former Microsoft employee or contractor, though attribution remains unconfirmed.

As of disclosure (2026-07-15), Microsoft has not assigned a CVE ID, published a security advisory, or shipped a patch for LegacyHive specifically. The PoC was independently verified by the discloser to function against 'all currently supported desktop and server' Windows builds with the July 2026 Patch Tuesday security updates applied (that cycle addressed roughly 570 vulnerabilities including 3 separate zero-days), meaning the flaw survived Microsoft's most recent monthly patch cycle. No in-the-wild exploitation, malware integration, or threat-actor weaponization of LegacyHive itself has been reported; unlike BlueHammer, this is presently a disclosed research primitive rather than an observed ransomware-enabling campaign. Given the same actor's track record (BlueHammer went from PoC to CISA-KEV-listed ransomware tooling within under three months), defenders should treat LegacyHive as a credible, unpatched local elevation/lateral-disclosure vector on multi-user Windows hosts (terminal servers, shared workstations, RDS/VDI) pending an official Microsoft fix, and should assume the actor may escalate, weaponize, or chain it with future disclosures.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1587.004 Exploits
- T1585.001 Social Media Accounts
- T1078.003 Local Accounts
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1012 Query Registry
- T1033 System Owner/User Discovery
- T1069 Permission Groups Discovery
- T1552.002 Credentials in Registry
- T1003 OS Credential Dumping
- T1005 Data from Local System
- T1112 Modify Registry
- T1685 Disable or Modify Tools
- T1486 Data Encrypted for Impact

## Sources

- [New LegacyHive Windows 0-day Vulnerability Allows Users to Load Another User's Registry](https://cybersecuritynews.com/legacyhive-windows-0-day-vulnerability/)
- [MSNightmare/LegacyHive (GitHub PoC repository)](https://github.com/MSNightmare/LegacyHive)
- [LegacyHive/README.md — Project NightCrawler mirror](https://git.projectnightcrawler.dev/NightmareEclipse/LegacyHive/src/branch/main/README.md)
- [Nightmare Eclipse could be dropping his big promised exploit today](https://radar.offseq.com/threat/nightmare-eclipse-could-be-dropping-his-big-promis-f402efe8c31193ec)
- [Windows Registry Hive Exploitation — HackTricks](https://hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation/windows-registry-hive-exploitation.html)
- [Nightmare-Eclipse: six zero-days, six weeks and one big grudge](https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge)
- [BlueHammer: Windows zero-day exploit leaked](https://www.helpnetsecurity.com/2026/04/08/bluehammer-windows-zero-day-exploit-leaked/)
- [CISA: Windows BlueHammer flaw now exploited by ransomware gangs](https://www.bleepingcomputer.com/news/security/cisa-windows-bluehammer-flaw-now-exploited-by-ransomware-gangs/)
- [CVE-2026-33825 'BlueHammer': Microsoft Defender Privilege Escalation to SYSTEM Confirmed in Ransomware Attacks](https://threat-modeling.com/cve-2026-33825-bluehammer-microsoft-defender-privilege-escalation-ransomware/)
- [Microsoft Windows < 8.1 (x86/x64) - User Profile Service Privilege Escalation (MS15-003)](https://www.exploit-db.com/exploits/35811)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1351