# LegacyHive: Windows User Profile Service (ProfSvc) Local Privilege Escalation Zero-Day PoC (Unpatched, No CVE)

> Researcher Nightmare-Eclipse (aka Chaotic Eclipse, Dead Eclipse) publicly released 'LegacyHive', a PoC abusing arbitrary registry hive loading in the Windows User Profile Service (profsvc) to let a standard user mount another user's hive - potentially a local administrator's - into their own profile. It works against all supported, fully patched Windows versions and has no CVE or Microsoft advisory as of publication.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1414
- **ID:** TL-2026-1414
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Nightmare Eclipse
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 14, 2026, hours after Microsoft's July 2026 Patch Tuesday, the researcher known as Nightmare-Eclipse (also Chaotic Eclipse and Dead Eclipse) released 'LegacyHive' on GitHub (github.com/MSNightmare/LegacyHive, mirrored at git.projectnightcrawler.dev/NightmareEclipse/LegacyHive). LegacyHive is a local privilege escalation (LPE) proof-of-concept that abuses the Windows User Profile Service (profsvc) - the RPC service responsible for loading and unloading user registry hives during logon/logoff - to perform an arbitrary registry hive load. A standard-user attacker who already has local code execution can trigger profsvc into mounting a different user's hive, including a local administrator's, under the classes root of their own profile, exposing registry data (and, per the researcher, potentially write access) that should remain isolated per-user.

The publicly released PoC is deliberately crippled: it is restricted to the usrclass.dat hive and requires the attacker to already possess a second, separate set of standard-user credentials in addition to the target administrator username. The researcher stated the original, unreleased variant required no additional credentials and was not limited to usrclass.dat - it could load any registry hive - but was withheld 'to prevent the security defect's in-the-wild exploitation.' Independent researchers Kevin Beaumont and Will Dormann confirmed the stripped PoC functions as described, including against systems fully updated with the July 2026 Patch Tuesday release, meaning the flaw is a true zero-day with no available fix. Threat-intel commentary (Register, Barracuda) assessed that a capable attacker could reverse-engineer the missing credential-free/any-hive capability and produce a fully weaponized version in short order; researcher Matei Badanoiu described the primitive as 'genuinely useful' for post-compromise privilege escalation and lateral movement within a compromised host.

LegacyHive is the seventh zero-day released by Nightmare-Eclipse since April 2026 (following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma/RoguePlanet), all publicly dumped without coordinated disclosure. The researcher, who claims to be a disgruntled former Microsoft-adjacent security professional, states the releases are protest disclosures against Microsoft Security Response Center (MSRC), alleging MSRC revoked their portal access, dismissed confirmed vulnerability reports, withheld bounty payment, and defamed them. Microsoft has responded by disabling the researcher's accounts and signaling possible legal action, while publicly stating only that it is 'committed to investigating security issues and updating impacted products to protect customers as soon as possible' - no advisory, KB, or CVE has been published for LegacyHive. At least three of the researcher's prior releases (BlueHammer, RedSun, UnDefend) were observed weaponized in real-world intrusions shortly after disclosure, including delivery of a Go-based reverse-tunnel implant (BeigeBurrow) tunneled through staybud.dpdns[.]org:443 and staged via VPN egress IPs in Russia, Singapore, and Switzerland - demonstrating this actor's PoCs have a track record of rapid in-the-wild weaponization, which elevates the operational urgency of LegacyHive despite no confirmed abuse of it specifically as of publication.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1003 OS Credential Dumping
- T1552.002 Credentials in Registry
- T1087 Account Discovery
- T1087.001 Local Account
- T1012 Query Registry
- T1112 Modify Registry
- T1548 Abuse Elevation Control Mechanism
- T1548.002 Bypass User Account Control
- T1685 Disable or Modify Tools
- T1059.003 Windows Command Shell
- T1078.003 Local Accounts
- T1547 Boot or Logon Autostart Execution
- T1021.001 Remote Desktop Protocol
- T1090.003 Multi-hop Proxy
- T1572 Protocol Tunneling
- T1071.001 Web Protocols
- T1587.004 Exploits
- T1583.001 Domains

## Sources

- [Researcher Drops New Windows Zero-Day PoC Hours After Microsoft Patch Tuesday](https://thehackernews.com/2026/07/researcher-drops-new-windows-zero-day.html)
- [Nightmare Eclipse Drops 'LegacyHive' Windows Zero-Day](https://www.securityweek.com/nightmare-eclipse-drops-legacyhive-windows-zero-day/)
- [LegacyHive: 'Bone-shattering' zero-day from Microsoft's serial tormentor not the haymaker that was promised](https://www.theregister.com/security/2026/07/15/microsofts-serial-tormentor-drops-legacyhive-0-day/5271723)
- [LegacyHive: Exploit Code and Full Details Publicly Disclosed for Unpatched Windows Privilege Escalation Flaw](https://securityonline.info/legacyhive-windows-exploit/)
- [Chaotic Eclipse Unveils LegacyHive Exploit Affecting Fully Patched Windows Systems](https://securityaffairs.com/195418/hacking/chaotic-eclipse-unveils-legacyhive-exploit-affecting-fully-patched-windows-systems.html)
- [Nightmare Eclipse drops new Windows privilege escalation vulnerability](https://cybernews.com/security/nightmare-eclipse-windows-legacyhive-privilege-escalation-bug/)
- [LegacyHive Zero-Day: Windows Privilege Escalation After Patch Tuesday](https://www.it-connect.tech/legacyhive-zero-day-hits-windows-just-after-july-patch-tuesday/)
- [LegacyHive Windows Zero-Day Exploitation and PoC Disclosure](https://detections.ai/intel-exchange/019f61c4-3e00-76ef-98cc-603dc45fae56)
- [Nightmare-Eclipse just dropped LegacyHive Windows privilege-escalation zero-day PoC](https://x.com/IntCyberDigest/status/2077145793333514593)
- [Nightmare-Eclipse: six zero-days, six weeks and one big grudge](https://blog.barracuda.com/2026/05/19/nightmare-eclipse-zero-days-grudge)
- [Nightmare-Eclipse: The 6 Windows Zero-Days From the Banned Researcher](https://ghosxt.com/blog/nightmare-eclipse-windows-zero-days-github-ban-smb-2026)
- [Defender Triple Zero-Day: BlueHammer, RedSun, and UnDefend](https://labs.cloudsecurityalliance.org/research/csa-research-note-defender-zero-days-bluehammer-redsun-undef/)
- [RoguePlanet: Anatomy of the Nightmare Eclipse Microsoft Defender Zero-Day](https://www.picussecurity.com/resource/blog/rogueplanet-anatomy-of-the-nightmare-eclipse-microsoft-defender-zero-day)
- [RedSun Zero-Day: When Defender Becomes the Delivery Mechanism](https://www.cyderes.com/howler-cell/redsun-zero-day)
- [Microsoft 0-day feud escalates as researcher threatens another Windows exploit dump](https://www.theregister.com/security/2026/05/28/microsoft-0-day-feud-escalates-as-researcher-threatens-another-windows-exploit-dump/5248085)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1414