HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation — Threadlinqs Intelligence
As of 2026-08-31, HardBreacher PoC Exploit Targets Kaspersky Endpoint Security Zero-Day for Windows 11 Local Privilege Escalation is a medium-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-2258 · Severity: MEDIUM · Status: UNCONFIRMED · Category: VULNERABILITY
Security researcher MSNightmare (aka NightmareEclipse / INFINITE NIGHTMARE / Chaotic Eclipse) published an unreliable public PoC, HardBreacher, that takes control of Kaspersky Endpoint Security's UI
On 2026-08-31, GitHub user MSNightmare released HardBreacher, a proof-of-concept local elevation-of-privilege (EoP) exploit targeting Kaspersky Endpoint Security v14.0.0.504 on a fully patched Windows 11 25H2 host. The PoC does not require network access, social engineering, or an existing administrative foothold -- only a standard local user account on an endpoint running the affected Kaspersky build. GBHackers' reporting characterizes the flaw as enabling 'unprivileged users to gain SYSTEM-level privileges through local access,' though the author's own repository notes the code does not yet reliably achieve arbitrary SYSTEM-level code execution.
The exploit works by taking control of Kaspersky's UI process (avp.exe), which runs with kernel-adjacent, security-product-level file-system permissions to perform real-time inspection. According to the author, 'the Kaspersky completely loses it when you take control over the UI process,' after which the tool can influence the product's internal file-operation decisions and write a marker file, MY_SNAKE_IS_SOLID.dll, into C:\Windows\System32 with full permissions granted to the invoking standard user -- a path normally protected by NTFS DACLs and Windows path virtualization. Placing the payload directly inside the legitimate System32 tree, rather than a user-writable location, blends the artifact with genuine OS/vendor files. The payload component is built as a Windows DLL (Visual C++ project 'SolidSnake': dllmain.cpp, framework.h, pch.h/.cpp) that includes ntdll.h, indicating use of undocumented/internal NT API calls rather than only public Win32 calls, consistent with a process-injection-based takeover of the target process; the GitHub repository README itself contains no explicit listing of individual Win32 API calls used.
The author explicitly describes the tool as a 'duct taped' proof-of-concept ('I just managed to make it work'): execution is unreliable, 'often ends in error, requiring retries,' and can leave the endpoint in a degraded state -- Kaspersky 'can stop functioning' or unpredictably 'grant/block access to files it's not supposed to.' GBHackers' coverage also frames a broader potential impact chain -- disabling security defenses, accessing protected data, and using credentials/tokens exposed to higher-privileged contexts for persistence or lateral movement -- but this framing is presented as potential downstream risk rather than something the PoC itself demonstrates; no persistence or lateral-movement behavior is documented in the exploit code or README. No coordinated disclosure to Kaspersky is documented in the repository.
HardBreacher was released the same day as two companion zero-day PoCs by the same researcher: PrettyPrague (a sandbox-escape EoP against fully patched Avast/Gen Digital Antivirus that dumps the SAM database and spawns a full SYSTEM shell) and GreenSection (an out-of-bounds write in a global NVIDIA user-mode shared-memory section, triggerable by any Vulkan- or OpenGL-using application, that can cross user boundaries or compromise the dwm.exe process). This researcher -- publicly known as MSNightmare / NightmareEclipse / INFINITE NIGHTMARE / Chaotic Eclipse -- has a documented Spring-2026 history of publishing unconfirmed, largely uncoordinated PoCs against Windows security tooling and OS components: BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, MiniPlasma, ShieldBreak, RoguePlanet (referencing the already-patched, NVD-published CVE-2026-50656, a Microsoft Malware Protection Engine EoP), LegacyHive (Windows ProfSvc), and GreatXML (a BitLocker bypass); some of these prior PoCs reportedly achieved SYSTEM privileges or disk-protection bypass. A single Spanish-language outlet (securitylab.lat) additionally reports that Microsoft closed the researcher's coordinated-disclosure account over an alleged breach of reporting terms, a claim Microsoft is reported to dispute as uncoordinated disclosure on the researcher's part; this dispute is uncorrob
Weaknesses (CWE)
CWE-732, CWE-269
Timeline
- NVD publishes CVE-2026-50656 ('RoguePlanet'), an elevation-of-privilege flaw in the Microsoft Malware Protection Engine used by Microsoft Defender, previously disclosed by the same researcher (MSNightmare/NightmareEclipse) -- establishing a documented pattern of security-tool-targeting disclosures predating HardBreacher.
- MSNightmare publishes the HardBreacher proof-of-concept on GitHub (MIT license), describing a local elevation-of-privilege flaw in Kaspersky Endpoint Security v14.0.0.504 on fully patched Windows 11 25H2.
- The same researcher simultaneously publishes two related zero-day PoCs against other vendors: PrettyPrague (Avast Antivirus sandbox-escape EoP) and GreenSection (NVIDIA shared-memory out-of-bounds write).
- GBHackers publishes the first English-language security-news coverage of HardBreacher, noting no CVE assignment and no Kaspersky confirmation at time of writing.
- MalwareTips security forum publishes community discussion and a technical breakdown of the HardBreacher disclosure.
- Russian-language outlets (anti-malware.ru, securitylab.lat, Rambler News) publish coverage of the HardBreacher disclosure and the researcher's broader pattern of targeting security vendors the same day.
- anti-malware.ru reports, citing unnamed sourcing, that Kaspersky released an automatic update resolving the issue found by HardBreacher; this claim is not corroborated by Kaspersky's own advisory feed or by any other outlet as of this writing.
- No official Kaspersky security advisory (KLA bulletin) or CVE referencing HardBreacher or Kaspersky Endpoint Security v14.0.0.504 has been published or located as of this date; threats.kaspersky.com has no matching entry.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, MEDIUM, threat intelligence, cybersecurity, T1588.005, T1587.004, T1106, T1055.001, T1548, T1685, T1222.001, T1036.005, T1489
