LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)

LegacyHive: Windows User Profile Service (ProfSvc) Local (TL-2026-1414), also tracked as LegacyHive, is a high-severity software vulnerability, first published 2026-07-16. It is attributed to Nightmare Eclipse with high confidence, affects Microsoft Windows (all supported desktop and server versions), maps to 20 MITRE ATT&CK techniques (T1003, T1012, T1021.001), and is covered by 9 detection rules and 24 indicators of compromise.

Key facts for TL-2026-1414

Threat ID
TL-2026-1414
Also known as
LegacyHive
Severity
HIGH
Status
ACTIVE
Category
VULNERABILITY
First published
2026-07-16
Last reviewed
2026-07-16
Attribution
Nightmare Eclipse
Attribution confidence
HIGH
Motivation
UNKNOWN
Target sectors
all sectors broad windows install base, government administration, finance, health, technology, managed service providers
Target regions
Global
Detection rules
9
Indicators of compromise
24

Malware and tooling in LegacyHive: Windows User Profile Service (ProfSvc) Local

Malware and tooling: BeigeBurrow, BlueHammer, RedSun, RoguePlanet, UnDefend, LegacyHive

Researcher Nightmare-Eclipse (aka Chaotic Eclipse, Dead Eclipse) publicly released 'LegacyHive', a PoC abusing arbitrary registry hive loading in the Windows User Profile Service (profsvc) to let a standard user mount another user's hive - potentially a local administrator's - into their own profile. It works against all supported, fully patched Windows versions and has no CVE or Microsoft advisory as of publication.

How LegacyHive: Windows User Profile Service (ProfSvc) Local works

On July 14, 2026, hours after Microsoft's July 2026 Patch Tuesday, the researcher known as Nightmare-Eclipse (also Chaotic Eclipse and Dead Eclipse) released 'LegacyHive' on GitHub (github.com/MSNightmare/LegacyHive, mirrored at git.projectnightcrawler.dev/NightmareEclipse/LegacyHive). LegacyHive is a local privilege escalation (LPE) proof-of-concept that abuses the Windows User Profile Service (profsvc) - the RPC service responsible for loading and unloading user registry hives during logon/logoff - to perform an arbitrary registry hive load. A standard-user attacker who already has local code execution can trigger profsvc into mounting a different user's hive, including a local administrator's, under the classes root of their own profile, exposing registry data (and, per the researcher, potentially write access) that should remain isolated per-user.

The publicly released PoC is deliberately crippled: it is restricted to the usrclass.dat hive and requires the attacker to already possess a second, separate set of standard-user credentials in addition to the target administrator username. The researcher stated the original, unreleased variant required no additional credentials and was not limited to usrclass.dat - it could load any registry hive - but was withheld 'to prevent the security defect's in-the-wild exploitation.' Independent researchers Kevin Beaumont and Will Dormann confirmed the stripped PoC functions as described, including against systems fully updated with the July 2026 Patch Tuesday release, meaning the flaw is a true zero-day with no available fix. Threat-intel commentary (Register, Barracuda) assessed that a capable attacker could reverse-engineer the missing credential-free/any-hive capability and produce a fully weaponized version in short order; researcher Matei Badanoiu described the primitive as 'genuinely useful' for post-compromise privilege escalation and lateral movement within a compromised host.

LegacyHive is the seventh zero-day released by Nightmare-Eclipse since April 2026 (following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma/RoguePlanet), all publicly dumped without coordinated disclosure. The researcher, who claims to be a disgruntled former Microsoft-adjacent security professional, states the releases are protest disclosures against Microsoft Security Response Center (MSRC), alleging MSRC revoked their portal access, dismissed confirmed vulnerability reports, withheld bounty payment, and defamed them. Microsoft has responded by disabling the researcher's accounts and signaling possible legal action, while publicly stating only that it is 'committed to investigating security issues and updating impacted products to protect customers as soon as possible' - no advisory, KB, or CVE has been published for LegacyHive. At least three of the researcher's prior releases (BlueHammer, RedSun, UnDefend) were observed weaponized in real-world intrusions shortly after disclosure, including delivery of a Go-based reverse-tunnel implant (BeigeBurrow) tunneled through staybud.dpdns[.]org:443 and staged via VPN egress IPs in Russia, Singapore, and Switzerland - demonstrating this actor's PoCs have a track record of rapid in-the-wild weaponization, which elevates the operational urgency of LegacyHive despite no confirmed abuse of it specifically as of publication.

MITRE ATT&CK techniques used in TL-2026-1414

Credential Access

T1003 OS Credential Dumping; T1552.002 Credentials in Registry

Discovery

T1012 Query Registry; T1087 Account Discovery; T1087.001 Local Account

Lateral Movement

T1021.001 Remote Desktop Protocol

Execution

T1059.003 Windows Command Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Command and Control

T1071.001 Web Protocols; T1090.003 Multi-hop Proxy; T1572 Protocol Tunneling

Persistence

T1078.003 Local Accounts; T1547 Boot or Logon Autostart Execution

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

privilege-escalation

T1548 Abuse Elevation Control Mechanism; T1548.002 Bypass User Account Control

Resource Development

T1583.001 Domains; T1587.004 Exploits

Affected products and versions in LegacyHive: Windows User Profile Service (ProfSvc) Local

  • Microsoft — Windows (all supported desktop and server versions)
    Vulnerable versions: Windows 10 (all supported servicing channels, July 2026 Patch Tuesday applied); Windows 11 (all supported servicing channels, July 2026 Patch Tuesday applied); Windows Server (all currently supported versions, July 2026 Patch Tuesday applied)

Remediation for LegacyHive: Windows User Profile Service (ProfSvc) Local

Patches

  • No vendor patch exists as of publication (July 16, 2026); Microsoft has not issued an advisory or CVE for LegacyHive

Immediate actions

  • Treat LegacyHive as an unpatched zero-day: there is no vendor patch or KB to apply as of publication
  • Restrict and monitor local logon rights on high-value Windows hosts (servers, admin workstations, jump boxes) to reduce the pool of standard users who can stage the exploit
  • Enforce least-privilege local accounts; avoid maintaining unused or shared standard-user credentials on hosts where administrators also log on
  • Enable and centrally forward Windows Security auditing for User Profile Service (profsvc) events and registry hive load/unload activity (Event IDs in the Microsoft-Windows-User Profile Service operational log)
  • Monitor for anomalous RegLoadKey/RegLoadAppKey API calls and unexpected mounting of foreign user hives under HKEY_CLASSES_ROOT / HKEY_USERS of a non-owning profile
  • Block or alert on execution of the public LegacyHive PoC binary/script signatures and known file paths associated with Nightmare-Eclipse prior tooling (BlueHammer, RedSun, UnDefend, BeigeBurrow)
  • Alert on outbound connections to staybud.dpdns[.]org:443 and the associated VPN egress IPs tied to prior campaigns using this actor's tooling

Workarounds

  • Restrict standard-user local logon on systems where administrators authenticate
  • Increase auditing/alerting on profsvc and registry hive load operations to detect exploitation attempts pending an official fix

Longer-term hardening

  • Deploy EDR with registry-hive and profile-service-specific behavioral detections, not just signature matching, given the PoC is expected to be re-weaponized/extended by third parties
  • Segment administrator logon sessions away from shared or multi-user hosts where standard users can stage local privilege escalation chains
  • Track Microsoft's advisory pipeline for a forthcoming CVE/patch covering profsvc arbitrary hive loading and prioritize expedited deployment once released
  • Maintain a watchlist for Nightmare-Eclipse/Chaotic Eclipse future disclosures given the actor's pattern of serial, uncoordinated Windows zero-day releases since April 2026

Weaknesses (CWE) in LegacyHive: Windows User Profile Service (ProfSvc) Local

CWE-269, CWE-863, CWE-284

Timeline of LegacyHive: Windows User Profile Service (ProfSvc) Local

  • Nightmare-Eclipse (Chaotic Eclipse/Dead Eclipse) begins publicly dumping uncoordinated Windows zero-days on GitHub/GitLab, beginning with BlueHammer, citing MSRC disclosure disputes.
  • RedSun, UnDefend, and related tooling released; researcher claims MSRC revoked portal access, dismissed reports, and withheld bounty payment.
  • Barracuda Networks publishes 'six zero-days, six weeks and one big grudge' profiling the researcher's release cadence and motive.
  • The Register reports the Microsoft-researcher feud escalating, with the researcher threatening a further Windows exploit dump.
  • Huntress reports BlueHammer, RedSun, and UnDefend tooling observed weaponized in real-world intrusions, including the BeigeBurrow Go-based reverse-tunnel implant communicating to staybud.dpdns[.]org:443.
  • Hours after Patch Tuesday, Nightmare-Eclipse publicly releases the LegacyHive PoC on GitHub (github.com/MSNightmare/LegacyHive) and a mirror, describing a profsvc arbitrary registry hive load flaw affecting all supported, fully patched Windows versions.
  • Microsoft ships the July 2026 Patch Tuesday updates.
  • The Hacker News, SecurityWeek, The Register, Security Affairs, Cybernews, IT-Connect, and securityonline.info publish coverage; Microsoft states only that it is investigating, with no advisory, KB, or CVE issued.
  • Independent researchers Kevin Beaumont and Will Dormann confirm the stripped-down PoC functions as described against fully patched systems, with no available fix.
  • TL-Intel Harness ingests the threat via RSS hunt and completes RESEARCH-phase analysis; no CVE, patch, or confirmed in-the-wild exploitation of LegacyHive specifically has been reported as of this date.

Sources cited for LegacyHive: Windows User Profile Service (ProfSvc) Local

Threats related to LegacyHive: Windows User Profile Service (ProfSvc) Local

Detection coverage for TL-2026-1414

As of 2026-07-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1414 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats