Loading threat actor…
Nightmare Eclipse is an anonymous exploit developer and vulnerability-disclosure actor active publicly since April 2026, also known as Nightmare-Eclipse, NightmareEclipse, Chaotic Eclipse, Infinite Nightmare, MSNightmare, and Dead Eclipse. The aliases identify a single researcher rather than established subgroups. The actor publishes Windows and endpoint-security proof-of-concept exploits without coordinated vendor disclosure, frequently around Microsoft's Patch Tuesday releases. Their identity, country of origin, and any state affiliation are not established. The actor's work primarily exploits design-level weaknesses in trusted security functionality, including Microsoft Defender scanning and remediation, Windows profile loading, recovery environments, and third-party endpoint products. Techniques include time-of-check/time-of-use races, NTFS junctions, opportunistic locks, Object Manager symbolic links, Cloud Files hydration, privileged file-operation redirection, credential-hash extraction, and DLL sideloading. Releases include BlueHammer, RedSun, UnDefend, RoguePlanet, ShieldBreak, ShieldCrash, LegacyHive, and GreatXML. Independently reproduced capabilities include standard-user escalation to SYSTEM, interference with Defender updates and protection, cross-user registry-data access, and post-compromise access to BitLocker-protected data. GreatXML requires prior administrator access and supports later physical-access data retrieval; it does not break BitLocker cryptography. A revised ShieldCrash demonstrated unauthorized protected-file reading, but not arbitrary writing or full SYSTEM execution. The actor subsequently expanded into CrowdStrike Falcon, Avast Antivirus, Kaspersky Endpoint Security, and NVIDIA GPU drivers through FalconFlank, PrettyPrague, HardBreacher, and GreenSection. Validated effects include SYSTEM escalation, execution within a trusted security-product process, and crashes; GreenSection has not demonstrated privilege escalation. BlueHammer, RedSun, and UnDefend have been exploited by third parties in real-world intrusions, including ransomware operations. That downstream adoption does not establish that Nightmare Eclipse conducts ransomware attacks.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
60 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
16 malware families Mallory has associated with this actor across public reporting.
11 additional families tracked in Mallory.
4 CVEs Mallory has associated with this actor across public reporting. 4 of them are exploited in the wild (not necessarily by this actor).
17 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.