Threat reportVulnerabilityTL-2026-1865
NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions
NightmareEclipse Coordinated Disclosure Breach Campaign (TL-2026-1865), also tracked as Operation Nightmare Eclipse, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-08-04 and last reviewed 2026-10-16. It is attributed to NightmareEclipse with medium confidence, affects Microsoft Windows Defender Antimalware Platform, references 6 CVEs (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498), maps to 27 MITRE ATT&CK techniques (T1003, T1033, T1036), and is covered by 9 detection rules and 38 indicators of compromise.
- CVSS
- 7.8/10Critical
- CVEs
- 6Referenced vulnerabilities
- Techniques
- 27MITRE ATT&CK
- Actors
- 1NightmareEclipse
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 38Indicators of compromise
Key facts for TL-2026-1865
- Threat ID
- TL-2026-1865
- Also known as
- Operation Nightmare Eclipse, BlueHammer-RedSun Campaign, Chaotic Eclipse Zero-Day Spree
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution
- NightmareEclipse
- Attribution confidence
- MEDIUM
- Motivation
- DESTRUCTION
- Target sectors
- government administration, finance, health, technology, critical-infrastructure
- Target regions
- North America, Europe, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 38
- Updates
- 2026-10-16 · 2 updates · revalidated 2× · latest source
Malware and tooling in NightmareEclipse Coordinated Disclosure Breach Campaign
Malware and tooling: BeigeBurrow, BlueHammer, LegacyHive, RedSun, UnDefend
How NightmareEclipse Coordinated Disclosure Breach Campaign works
A disgruntled security researcher operating under the alias NightmareEclipse (also Chaotic Eclipse, MSNightmare) publicly released nine unpatched Windows zero-day exploits outside coordinated disclosure between April and July 2026. The vulnerabilities target Windows Defender, BitLocker, CTFMON, the Cloud Filter driver (cldflt.sys), and the User Profile Service (ProfSvc), enabling local privilege escalation to SYSTEM and security feature bypass. Three CVEs appear on CISA's Known Exploited Vulnerabilities catalog as actively exploited. Huntress documented a real-world intrusion in April 2026 where adversaries deployed BlueHammer, RedSun, and UnDefend tools alongside a Go-based yamux reverse tunnel agent (BeigeBurrow) for C2, following a FortiGate SSL VPN compromise.
Between April and July 2026, a threat actor using the pseudonym NightmareEclipse (also tracking as Chaotic Eclipse and MSNightmare) systematically released nine separate zero-day proof-of-concept exploits for Microsoft Windows components — all outside of coordinated vulnerability disclosure (CVD) protocols. The actor claims Microsoft's Security Response Center (MSRC) mishandled prior vulnerability submissions, leaving them 'insulted, humiliated, and left homeless,' and stated the goal of causing 'maximum harm' to Microsoft. The resulting exploits have been weaponized in real-world intrusions documented by Huntress, with CISA adding three of the disclosed CVEs to the Known Exploited Vulnerabilities catalog.
The nine exploits span multiple attack surfaces across the Windows ecosystem:
BlueHammer (CVE-2026-33825, CWE-1220) — A TOCTOU race condition in Windows Defender Antimalware Platform (< 4.18.26030.3011) exploiting opportunistic locks (oplock) and Volume Shadow Copy to achieve SYSTEM-level privilege escalation via SAM database credential extraction. CVSS 7.8 (HIGH), actively exploited, added to CISA KEV April 22, 2026.
RedSun (CVE-2026-41091, CWE-59) — A symlink-following vulnerability in the Microsoft Malware Protection Engine (< 1.1.26040.8) enabling local privilege escalation to SYSTEM via COM object hijacking of the Storage Tiers Management Engine service. CVSS 7.8 (HIGH), actively exploited, added to CISA KEV May 20, 2026.
UnDefend (CVE-2026-45498, CWE-400) — A resource exhaustion vulnerability in Microsoft Defender Antimalware Platform (< 4.18.26040.7) that creates locked file handles on Defender signature definition files (mpavbase.lkg, mpavbase.vdm), temporarily disabling real-time protection until process exit. CVSS 7.5 (HIGH, NVD rating), actively exploited, added to CISA KEV May 20, 2026.
YellowKey (CVE-2026-45585, CWE-77) — A command injection vulnerability in Windows BitLocker enabling security feature bypass on systems using TPM-only pre-boot authentication (no PIN). A physical attacker can extract the decryption key from the TPM. CVSS 6.8 (MEDIUM), requires physical access. Affects Windows 11 24H2/25H2/26H1 and Windows Server 2025.
GreatXML (no CVE assigned) — A design-level abuse of Windows Recovery Environment (WinRE) that allows an attacker with administrative access to plant a malicious unattend.xml file on the recovery partition. Upon reboot into WinRE, the answer file processes before security boundaries enforce, spawning a SYSTEM shell with full access to BitLocker-encrypted volumes without a recovery key. Requires prior admin access to plant the file — acts as a persistent backdoor surviving credential rotation. Independently tested by Cyderes (Howler Cell) who confirmed the attack chain.
GreenPlasma (CVE-2026-45586) — A local privilege escalation in the Windows Text Services Framework (CTFMON/CTF) subsystem combining Object Manager symbolic link placement and registry link abuse to create arbitrary memory sections in SYSTEM-writable object directories. Affects Windows 11 and Windows Server 2022/2025/2026. Builds on prior research by James Forshaw (Google Project Zero, 2019).
MiniPlasma (no CVE assigned) — A local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that revives a vulnerability originally reported by James Forshaw as CVE-2020-17103 but which remained exploitable. The function HsmOsBlockPlaceholderAccess fails to specify OBJ_FORCE_ACCESS_CHECK when creating registry objects, allowing an attacker using Anonymous token impersonation and a race condition to write to SYSTEM-level registry locations and spawn a full SYSTEM shell. Affects all Windows versions according to the researcher.
RoguePlanet (no CVE assigned) — A local privilege escalation exploiting a race condition in Windows Defender's scan-and-quarantine pipeline. Chains NTFS directory junctions, opportunistic locks (oplocks), Volume Shadow Copy, and Windows Error Reporting's QueueReporting scheduled task (which runs as SYSTEM) to execute an arbitrary binary from a redirected wermgr.exe path. Affects Windows 10 and Windows 11; does not work on Server. Independently reproduced by Cyderes. No patch exists; Microsoft Defender signature detection ('Exploit:Win32/DfndrRugPlnt.BB') targets only the specific compiled sample.
LegacyHive (no CVE assigned, no patch) — A local privilege escalation in the Windows User Profile Service (ProfSvc) enabling arbitrary registry hive loading. Chains offline NTUSER.DAT modification, Object Manager symbolic link redirection, and a batch opportunistic lock. The publicly released PoC is stripped to require user credentials (the original required none and could load any hive). Microsoft is 'actively investigating.' Confirmed working on all supported Windows versions with July 2026 patch.
The Huntress Security Operations Center documented a real-world intrusion (April 2026) where adversaries used a compromised FortiGate SSL VPN (Russian IP 78.29.48.29) for initial access, then deployed BlueHammer, RedSun, and UnDefend for privilege escalation attempts. While all three tools failed in this particular intrusion, the adversaries successfully deployed and maintained persistence via BeigeBurrow, a Go-compiled reverse tunnel agent using HashiCorp's yamux library for multiplexed C2 communication to staybud.dpdns.org:443. Huntress also observed BeigeBurrow in at least one unrelated intrusion, suggesting the tool may be shared among multiple threat actors. The intrusion included hands-on-keyboard reconnaissance (whoami /priv, cmdkey /list, net group) and demonstrated the practical danger of publicly available zero-day tooling even when the original PoC authors had not fully weaponized the exploits.
MITRE ATT&CK techniques used in TL-2026-1865
Credential Access
T1003 OS Credential Dumping; T1555 Credentials from Password Stores
Discovery
T1033 System Owner/User Discovery; T1069 Permission Groups Discovery; T1082 System Information Discovery; T1087 Account Discovery
Defense Evasion
T1036 Masquerading; T1112 Modify Registry; T1211 Exploitation for Defense Evasion; T1542.001 Pre-OS Boot: System Firmware; T1562 Impair Defenses
Persistence
Privilege Escalation
T1055 Process Injection; T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation; T1546 Event Triggered Execution
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol; T1571 Non-Standard Port; T1572 Protocol Tunneling
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Impact
stealth
Resource Development
Reconnaissance
T1589 Gather Victim Identity Information
defense-impairment
Affected products and versions in NightmareEclipse Coordinated Disclosure Breach Campaign
- Microsoft — Windows Defender Antimalware Platform
Vulnerable versions: < 4.18.26030.3011 (BlueHammer); < 4.18.26040.7 (UnDefend)
Fixed in: ≥ 4.18.26030.3011; ≥ 4.18.26040.7 - Microsoft — Malware Protection Engine
Vulnerable versions: < 1.1.26040.8
Fixed in: ≥ 1.1.26040.8 - Microsoft — Windows 11 24H2
Vulnerable versions: < 10.0.26100.8655
Fixed in: ≥ 10.0.26100.8655 - Microsoft — Windows 11 25H2
Vulnerable versions: < 10.0.26200.8655
Fixed in: ≥ 10.0.26200.8655 - Microsoft — Windows 11 26H1
Vulnerable versions: < 10.0.28000.2269
Fixed in: ≥ 10.0.28000.2269 - Microsoft — Windows Server 2025
Vulnerable versions: < 10.0.26100.32995
Fixed in: ≥ 10.0.26100.32995 - Microsoft — Windows BitLocker
Vulnerable versions: TPM-only configurations (no PIN)
Fixed in: TPM+PIN configuration - Microsoft — Windows CTFMON / Text Services Framework
Vulnerable versions: Windows 11; Windows Server 2022; Windows Server 2025; Windows Server 2026
Fixed in: No patch available - Microsoft — Windows Cloud Filter Driver (cldflt.sys)
Vulnerable versions: All Windows versions
Fixed in: No patch available - Microsoft — Windows User Profile Service (ProfSvc)
Vulnerable versions: All supported Windows desktop and server installations with July 2026 patch
Fixed in: No patch available
Remediation for NightmareEclipse Coordinated Disclosure Breach Campaign
Patches
- CVE-2026-33825: KB for Defender Antimalware Platform ≥ 4.18.26030.3011 (released April 2026)
- CVE-2026-41091: KB for Malware Protection Engine ≥ 1.1.26040.8 (released May 2026)
- CVE-2026-45498: KB for Defender Antimalware Platform ≥ 4.18.26040.7 (released May 2026)
- CVE-2026-45585: Windows monthly rollup for builds 26100.8655, 26200.8655, 28000.2269, 26100.32995
- CVE-2026-45586: No official patch released as of August 2026
- GreatXML, RoguePlanet, MiniPlasma, LegacyHive: No patches or CVEs issued as of August 2026
Immediate actions
- Apply Microsoft Defender Antimalware Platform update ≥ 4.18.26030.3011 (patches CVE-2026-33825 / BlueHammer)
- Apply Microsoft Malware Protection Engine update ≥ 1.1.26040.8 (patches CVE-2026-41091 / RedSun)
- Apply Microsoft Defender Antimalware Platform update ≥ 4.18.26040.7 (patches CVE-2026-45498 / UnDefend)
- Apply Windows monthly security update for builds 10.0.26100.8655+, 10.0.26200.8655+, 10.0.28000.2269+ (patches CVE-2026-45585 / YellowKey)
- Enable TPM+PIN pre-boot authentication on all BitLocker-protected devices to mitigate YellowKey
- Monitor recovery partition root for unauthorized unattend.xml or Recovery/WindowsRE directory writes
- Block C2 domain staybud.dpdns.org at network perimeter and DNS layers
- Block IPs 78.29.48.29, 212.232.23.69, 179.43.140.214 at perimeter
Workarounds
- Enable TPM+PIN on all BitLocker-protected devices (mitigates YellowKey and limits GreatXML impact)
- Restrict ability to mount and write to recovery partitions via Group Policy
- Disable Cloud Files filter driver (cldflt.sys) on non-cloud-synced systems if feasible
- Monitor and restrict Windows Error Reporting QueueReporting scheduled task modifications
Longer-term hardening
- Deploy EDR with behavioral detection rules for NTFS junction/oplock/VSS abuse chains
- Hunt for whoami /priv, cmdkey /list, net group execution near non-standard binary paths
- Review VPN access logs for multi-geography same-user logins as lateral movement indicator
- Alert on agent.exe -server execution patterns (BeigeBurrow C2 agent)
- Implement registry modification monitoring for CloudFiles\BlockedApps symbolic link creation (MiniPlasma IOC)
- Develop YARA rule coverage for BeigeBurrow via RussianPanda95 win_mal_BeigeBurrow.yar
- Apply principle of least privilege to reduce LPE blast radius
CVEs associated with NightmareEclipse Coordinated Disclosure Breach Campaign
CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586, CVE-2020-17103
Weaknesses (CWE) in NightmareEclipse Coordinated Disclosure Breach Campaign
Timeline of NightmareEclipse Coordinated Disclosure Breach Campaign
Showing the 20 most recent tracked events.
- Microsoft fixes BlueHammer (CVE-2026-33825) in April 2026 Patch Tuesday.
- FortiGate SSL VPN compromised via stolen credentials from Russian IP 78.29.48.29; additional VPN connections observed from Singapore (212.232.23.69) and Switzerland (179.43.140.214)
- RedSun.exe and UnDefend (undef.exe) executed from user Downloads folders during the same intrusion; adversary also deployed BeigeBurrow reverse tunnel agent connecting to staybud.dpdns.org:443
- Huntress publishes intrusion analysis documenting Nightmare Eclipse tooling (BlueHammer, RedSun, UnDefend, BeigeBurrow) in a real-world compromise; notes tools largely failed but BeigeBurrow C2 persisted
- CISA adds CVE-2026-33825 (BlueHammer) to Known Exploited Vulnerabilities catalog under BOD 22-01 with remediation due May 6, 2026
- GreenPlasma (CVE-2026-45586) published — local privilege escalation in Windows Text Services Framework (CTFMON) exploiting Object Manager symlink placement and registry link abuse
- CISA adds CVE-2026-41091 (RedSun) and CVE-2026-45498 (UnDefend) to Known Exploited Vulnerabilities catalog with remediation due June 3, 2026
- Microsoft releases an automation script to remove autofstx.exe from WinRE BootExecute as a YellowKey (CVE-2026-45585) mitigation.
- Microsoft ships out-of-band patches for RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498) following reports of active exploitation.
- GitHub (Microsoft-owned) terminates NightmareEclipse's account following the zero-day disclosures.
- GitLab suspends the researcher's mirrored account, which had continued distributing the exploit tools after the GitHub takedown.
- NightmareEclipse threatens a further major exploit dump targeting July 14, 2026; Microsoft's Digital Crimes Unit publicly threatens legal action and law-enforcement coordination.
- Security-community backlash reported over Microsoft's Digital Crimes Unit threats and the researcher's doxxing on Twitter/X; industry figures (Kevin Beaumont, Dustin Childs, Katie Moussouris) publicly criticize Microsoft's response.
- Researcher indicates unspecified constraints are preventing further exploit/document releases during June 2026, ahead of the previously threatened July 14 disclosure.
- Per the newer report (citing BleepingComputer), June 2026 Patch Tuesday fixes YellowKey, GreenPlasma (CVE-2026-45586) and MiniPlasma (CVE-2020-17103); the exact day is derived from the Patch Tuesday calendar, not stated in the source, and conflicts with this record's earlier 'no patch' statements for GreenPlasma/MiniPlasma.
- GreatXML BitLocker bypass published — abuses WinRE unattend.xml processing to gain SYSTEM shell on BitLocker-encrypted volumes; RoguePlanet also published — race condition in Windows Defender quarantine pipeline chains oplock/VSS/WER for SYSTEM escalation
- YellowKey (CVE-2026-45585) BitLocker security feature bypass published — extracts TPM-stored keys on TPM-only systems without PIN authentication; affects Windows 11 24H2/25H2/26H1 and Server 2025
- LegacyHive published — ninth zero-day from NightmareEclipse, targeting Windows User Profile Service (ProfSvc) for arbitrary registry hive loading via offline NTUSER.DAT modification, Object Manager symlinks, and oplock race condition; PoC stripped to require user credentials
- Microsoft July 2026 Patch Tuesday addresses 622 vulnerabilities — the largest in company history — partially attributed by Microsoft to AI-assisted vulnerability discovery; some NightmareEclipse CVEs patched but GreatXML, RoguePlanet, MiniPlasma, and LegacyHive remain unaddressed
- Microsoft bug bounty program reports FY2026 record ($20M+ to 562 researchers); The Register article details NightmareEclipse's ongoing zero-day campaign and Microsoft's threat of Digital Crimes Unit involvement
Update history for TL-2026-1865
- 2026-10-16 — Nightmare Eclipse Windows zero-day disclosures with public PoC (BlueHammer CVE-2026-33825, UnDefend CVE-2026-45498, RedSun CVE-2026-41091, YellowKey CVE-2026-45585) amid Microsoft disclosure dispute: What changed No severity, exploitability, status or attribution change. The newer report is a narrower subset (six of nine disclosures) and rates the threat lower (HIGH, LOW attribution confidence); no downgrade is applied. New indicators (
- 2026-08-24 — "Nightmare Eclipse" Windows Defender Zero-Day Campaign — Six PoCs, Active Exploitation, and Microsoft's GitHub/GitLab/MSRC Bans: What changed Attribution confidence LOW → MEDIUM given Microsoft's identity-linked actions (GitHub/GitLab account bans, MSRC account disablement, public doxxing). Severity/exploitability/status unchanged — existing CRITICAL/ACTIVE/ACTIVE re
Sources cited for NightmareEclipse Coordinated Disclosure Breach Campaign
- The Register — AI helps Microsoft bug hunters chase a record $20M payday
- NVD — CVE-2026-33825 (BlueHammer / Windows Defender Insufficient Granularity of Access Control)
- NVD — CVE-2026-41091 (RedSun / Defender Link Following LPE)
- NVD — CVE-2026-45498 (UnDefend / Defender Denial of Service)
- NVD — CVE-2026-45585 (YellowKey / BitLocker Security Feature Bypass)
- Huntress — Nightmare Eclipse Tooling Seen in Real-World Intrusion
- The Register — Microsoft's worst 'Nightmare' unleashes BitLocker bypass 0-day (GreatXML)
- SecurityWeek — Nightmare Eclipse Drops 'LegacyHive' Windows Zero-Day
- CSO Online — GreatXML zero-day BitLocker bypass doesn't seem to work, yet
- Cyderes (Howler Cell) — GreatXML: Windows Zero-Day Turns Defender Offline Scan Into BitLocker Backdoor
- Cyderes (Howler Cell) — LegacyHive: Windows User Profile Loading Vulnerability
- Blackfort Technology — GreenPlasma Windows CTF Injection Analysis
- Security Affairs — Chaotic Eclipse Strikes Again: New Zero-Day Unlocks BitLocker
- Mallory.ai — CVE-2026-45586 (GreenPlasma)
- CISA Known Exploited Vulnerabilities Catalog
Detection coverage for TL-2026-1865
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1865 across Splunk SPL, Microsoft KQL and Sigma, covering 38 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.