# NightmareEclipse Coordinated Disclosure Breach Campaign: 9+ Windows Zero-Days (CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586) Dumped Outside Responsible Disclosure and Weaponized in Real-World Intrusions

> A disgruntled security researcher operating under the alias NightmareEclipse (also Chaotic Eclipse, MSNightmare) publicly released nine unpatched Windows zero-day exploits outside coordinated disclosure between April and July 2026. The vulnerabilities target Windows Defender, BitLocker, CTFMON, the Cloud Filter driver (cldflt.sys), and the User Profile Service (ProfSvc), enabling local privilege escalation to SYSTEM and security feature bypass. Three CVEs appear on CISA's Known Exploited Vulnerabilities catalog as actively exploited. Huntress documented a real-world intrusion in April 2026 where adversaries deployed BlueHammer, RedSun, and UnDefend tools alongside a Go-based yamux reverse tunnel agent (BeigeBurrow) for C2, following a FortiGate SSL VPN compromise.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-10-16T16:57:31.363Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1865
- **ID:** TL-2026-1865
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** NightmareEclipse
- **Detections:** 9 · **IOCs:** 38 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825, CVE-2026-41091, CVE-2026-45498, CVE-2026-45585, CVE-2026-45586, CVE-2020-17103

## Description

Between April and July 2026, a threat actor using the pseudonym NightmareEclipse (also tracking as Chaotic Eclipse and MSNightmare) systematically released nine separate zero-day proof-of-concept exploits for Microsoft Windows components — all outside of coordinated vulnerability disclosure (CVD) protocols. The actor claims Microsoft's Security Response Center (MSRC) mishandled prior vulnerability submissions, leaving them 'insulted, humiliated, and left homeless,' and stated the goal of causing 'maximum harm' to Microsoft. The resulting exploits have been weaponized in real-world intrusions documented by Huntress, with CISA adding three of the disclosed CVEs to the Known Exploited Vulnerabilities catalog.

The nine exploits span multiple attack surfaces across the Windows ecosystem:

BlueHammer (CVE-2026-33825, CWE-1220) — A TOCTOU race condition in Windows Defender Antimalware Platform (< 4.18.26030.3011) exploiting opportunistic locks (oplock) and Volume Shadow Copy to achieve SYSTEM-level privilege escalation via SAM database credential extraction. CVSS 7.8 (HIGH), actively exploited, added to CISA KEV April 22, 2026.

RedSun (CVE-2026-41091, CWE-59) — A symlink-following vulnerability in the Microsoft Malware Protection Engine (< 1.1.26040.8) enabling local privilege escalation to SYSTEM via COM object hijacking of the Storage Tiers Management Engine service. CVSS 7.8 (HIGH), actively exploited, added to CISA KEV May 20, 2026.

UnDefend (CVE-2026-45498, CWE-400) — A resource exhaustion vulnerability in Microsoft Defender Antimalware Platform (< 4.18.26040.7) that creates locked file handles on Defender signature definition files (mpavbase.lkg, mpavbase.vdm), temporarily disabling real-time protection until process exit. CVSS 7.5 (HIGH, NVD rating), actively exploited, added to CISA KEV May 20, 2026.

YellowKey (CVE-2026-45585, CWE-77) — A command injection vulnerability in Windows BitLocker enabling security feature bypass on systems using TPM-only pre-boot authentication (no PIN). A physical attacker can extract the decryption key from the TPM. CVSS 6.8 (MEDIUM), requires physical access. Affects Windows 11 24H2/25H2/26H1 and Windows Server 2025.

GreatXML (no CVE assigned) — A design-level abuse of Windows Recovery Environment (WinRE) that allows an attacker with administrative access to plant a malicious unattend.xml file on the recovery partition. Upon reboot into WinRE, the answer file processes before security boundaries enforce, spawning a SYSTEM shell with full access to BitLocker-encrypted volumes without a recovery key. Requires prior admin access to plant the file — acts as a persistent backdoor surviving credential rotation. Independently tested by Cyderes (Howler Cell) who confirmed the attack chain.

GreenPlasma (CVE-2026-45586) — A local privilege escalation in the Windows Text Services Framework (CTFMON/CTF) subsystem combining Object Manager symbolic link placement and registry link abuse to create arbitrary memory sections in SYSTEM-writable object directories. Affects Windows 11 and Windows Server 2022/2025/2026. Builds on prior research by James Forshaw (Google Project Zero, 2019).

MiniPlasma (no CVE assigned) — A local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) that revives a vulnerability originally reported by James Forshaw as CVE-2020-17103 but which remained exploitable. The function HsmOsBlockPlaceholderAccess fails to specify OBJ_FORCE_ACCESS_CHECK when creating registry objects, allowing an attacker using Anonymous token impersonation and a race condition to write to SYSTEM-level registry locations and spawn a full SYSTEM shell. Affects all Windows versions according to the researcher.

RoguePlanet (no CVE assigned) — A local privilege escalation exploiting a race condition in Windows Defender's scan-and-quarantine pipeline. Chains NTFS directory junctions, opportunistic locks (oplocks), Volume Shadow Copy, and Windows Error Reporting's QueueReporting scheduled task (which runs as SYSTEM) to execute an arbitrary binary from a redirected wermgr.exe path. Affects Windows 10 and Windows 11; does not work on Server. Independently reproduced by Cyderes. No patch exists; Microsoft Defender signature detection ('Exploit:Win32/DfndrRugPlnt.BB') targets only the specific compiled sample.

LegacyHive (no CVE assigned, no patch) — A local privilege escalation in the Windows User Profile Service (ProfSvc) enabling arbitrary registry hive loading. Chains offline NTUSER.DAT modification, Object Manager symbolic link redirection, and a batch opportunistic lock. The publicly released PoC is stripped to require user credentials (the original required none and could load any hive). Microsoft is 'actively investigating.' Confirmed working on all supported Windows versions with July 2026 patch.

The Huntress Security Operations Center documented a real-world intrusion (April 2026) where adversaries used a compromised FortiGate SSL VPN (Russian IP 78.29.48.29) for initial access, then deployed BlueHammer, RedSun, and UnDefend for privilege escalation attempts. While all three tools failed in this particular intrusion, the adversaries successfully deployed and maintained persistence via BeigeBurrow, a Go-compiled reverse tunnel agent using HashiCorp's yamux library for multiplexed C2 communication to staybud.dpdns.org:443. Huntress also observed BeigeBurrow in at least one unrelated intrusion, suggesting the tool may be shared among multiple threat actors. The intrusion included hands-on-keyboard reconnaissance (whoami /priv, cmdkey /list, net group) and demonstrated the practical danger of publicly available zero-day tooling even when the original PoC authors had not fully weaponized the exploits.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1055 Process Injection
- T1546 Event Triggered Execution
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1003 OS Credential Dumping
- T1555 Credentials from Password Stores
- T1033 System Owner/User Discovery
- T1069 Permission Groups Discovery
- T1082 System Information Discovery
- T1572 Protocol Tunneling
- T1071 Application Layer Protocol
- T1485 Data Destruction
- T1068 Exploitation for Privilege Escalation
- T1562 Impair Defenses
- T1211 Exploitation for Defense Evasion
- T1571 Non-Standard Port
- T1589 Gather Victim Identity Information
- T1588 Obtain Capabilities
- T1134 Access Token Manipulation
- T1036 Masquerading
- T1112 Modify Registry
- T1542.001 Pre-OS Boot: System Firmware
- T1087 Account Discovery

## Sources

- [The Register — AI helps Microsoft bug hunters chase a record $20M payday](https://www.theregister.com/security/2026/08/04/ai-helps-microsoft-bug-hunters-chase-a-record-20m-payday/5282821)
- [NVD — CVE-2026-33825 (BlueHammer / Windows Defender Insufficient Granularity of Access Control)](https://nvd.nist.gov/vuln/detail/CVE-2026-33825)
- [NVD — CVE-2026-41091 (RedSun / Defender Link Following LPE)](https://nvd.nist.gov/vuln/detail/CVE-2026-41091)
- [NVD — CVE-2026-45498 (UnDefend / Defender Denial of Service)](https://nvd.nist.gov/vuln/detail/CVE-2026-45498)
- [NVD — CVE-2026-45585 (YellowKey / BitLocker Security Feature Bypass)](https://nvd.nist.gov/vuln/detail/CVE-2026-45585)
- [Huntress — Nightmare Eclipse Tooling Seen in Real-World Intrusion](https://www.huntress.com/blog/nightmare-eclipse-intrusion)
- [The Register — Microsoft's worst 'Nightmare' unleashes BitLocker bypass 0-day (GreatXML)](https://www.theregister.com/security/2026/06/11/nightmare-eclipse-drops-claimed-bitlocker-bypass-for-microsoft-windows/5254371)
- [SecurityWeek — Nightmare Eclipse Drops 'LegacyHive' Windows Zero-Day](https://www.securityweek.com/nightmare-eclipse-drops-legacyhive-windows-zero-day/)
- [CSO Online — GreatXML zero-day BitLocker bypass doesn't seem to work, yet](https://www.csoonline.com/article/4184678/greatxml-zero-day-bitlocker-bypass-doesnt-seem-to-work-yet.html)
- [Cyderes (Howler Cell) — GreatXML: Windows Zero-Day Turns Defender Offline Scan Into BitLocker Backdoor](https://www.cyderes.com/howler-cell/greatxml-windows-zero-day)
- [Cyderes (Howler Cell) — LegacyHive: Windows User Profile Loading Vulnerability](https://www.cyderes.com/howler-cell/legacyhive-windows-user-profile-loading-vulnerability)
- [Blackfort Technology — GreenPlasma Windows CTF Injection Analysis](https://blackfort-tec.de/en/insights/greenplasma-windows-ctf-injection-analysis)
- [Security Affairs — Chaotic Eclipse Strikes Again: New Zero-Day Unlocks BitLocker](https://securityaffairs.com/193516/security/chaotic-eclipse-strikes-again-new-zero-day-unlocks-bitlocker-in-four-hours-of-research.html)
- [Mallory.ai — CVE-2026-45586 (GreenPlasma)](https://mallory.ai/vulnerabilities/CVE-2026-45586)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1865