Loading story…
Huntress reported a confirmed enterprise intrusion in which an attacker appears to have gained access through a compromised FortiGate SSL VPN account and then deployed publicly available Nightmare-Eclipse tooling on Windows systems. The activity included execution of BlueHammer, RedSun, and UnDefend—tools designed to abuse Windows Defender logic flaws for privilege escalation or defense disruption—alongside hands-on-keyboard reconnaissance and suspicious VPN logins tied to infrastructure geolocated to Russia, Singapore, and Switzerland. Huntress said the privilege-escalation attempts did not appear to succeed in the investigated case, but the tooling was used in a live environment rather than as isolated proof-of-concept testing.
The attacker also deployed a Go-based reverse tunneling utility Huntress tracks as BeigeBurrow, which established outbound connectivity over port 443 to staybud.dpdns[.]org, helping maintain access after the VPN intrusion. Huntress observed suspicious binaries staged in low-privilege, user-writable directories and warned defenders to treat any execution of these tools as urgent incident activity. Microsoft patched BlueHammer in April 2026 as CVE-2026-33825, while RedSun and UnDefend remained unpatched at the time of reporting, underscoring the risk from publicly released exploit tooling being operationalized in real-world attacks.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
Huntress published its findings, describing the incident as the first confirmed in-the-wild use of Nightmare-Eclipse tools against a live enterprise environment. The company urged defenders to investigate endpoint, VPN, and tunneling telemetry for the observed artifacts and behaviors.
During the same compromise, Huntress saw hands-on-keyboard activity including enumeration commands and deployment of a Go-based reverse tunneling utility it named BeigeBurrow. The tunnel established outbound connectivity over port 443 to attacker infrastructure, including staybud.dpdns[.]org.
Huntress observed public Nightmare-Eclipse tooling—BlueHammer, RedSun, and UnDefend—executed during a real-world intrusion rather than isolated testing. The tools were staged in low-privilege writable directories, but the privilege-escalation attempts did not appear to succeed.
In the intrusion investigated by Huntress, an attacker appears to have gained unauthorized access using a compromised FortiGate SSL VPN account. Huntress observed suspicious VPN logins tied to the same account from infrastructure geolocated to Russia, Singapore, and Switzerland.
Microsoft patched the Windows Defender-related BlueHammer technique in April 2026 and assigned it CVE-2026-33825. At the time of Huntress's reporting, the related RedSun and UnDefend tools remained unpatched.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
infosec.pub
Open sourcecybersecuritynews.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A security researcher using the aliases **Chaotic Eclipse** and **Nightmare-Eclipse** publicly released working GitHub exploit code for **BlueHammer**, an unpatched Windows local privilege escalation flaw tied to Microsoft Defender’s signature update process. Independent testing by Will Dormann and others found the exploit worked, though reliability varied by platform and configuration. The attack abuses a **TOCTOU** race condition and path confusion in Defender’s update workflow, chaining components such as **VSS**, the **Cloud Files API**, and opportunistic locks to expose protected registry hives including `SAM`, `SYSTEM`, and `SECURITY`, extract NTLM password hashes, and potentially elevate a low-privileged user to **NT AUTHORITY\SYSTEM**. Microsoft initially responded with a Defender detection signature for the published proof of concept, but researchers warned that signature-based blocking did not address the underlying logic flaw. The issue was later tracked as **`CVE-2026-33825`** and patched by Microsoft on April 14, after which **CISA** ordered U.S. federal civilian agencies to remediate it within two weeks and added it to the **Known Exploited Vulnerabilities** catalog. Huntress reported the vulnerability was being used in zero-day intrusions involving hands-on-keyboard activity, and follow-on tooling such as **BlueSAM** showed how quickly the public disclosure was adapted for offensive use.
Jul 8, 2026
FBI and CISA warned that APT actors were actively scanning internet-facing Fortinet devices and exploiting multiple FortiOS vulnerabilities, including **`CVE-2018-13379`**, **`CVE-2020-12812`**, and **`CVE-2019-5591`**, to gain initial access and maintain a foothold for follow-on attacks. The agencies said the activity affected government, commercial, technology, and critical infrastructure organizations, with scanning observed on ports **4443**, **8443**, and **10443**. In one cited case, an APT group almost certainly exploited a FortiGate appliance to access a web server hosting a U.S. municipal government domain and likely created the username **`elie`** on the network. The campaign built on long-running exploitation of Fortinet SSL VPN weaknesses, especially the path traversal flaw **`CVE-2018-13379`**, which had already enabled the leak of credential-bearing session files from nearly **50,000** vulnerable devices worldwide. Those exposed **`sslvpn_websession`** files contained plaintext usernames and passwords, allowing attackers to reuse credentials even after patching. U.S. authorities said compromised access could support data exfiltration, ransomware-style encryption, and other post-exploitation activity, and highlighted indicators including FRP tunneling tools, unusual FTP traffic over port **443**, and a scheduled task named **`SynchronizeTimeZone`**.
Sep 3, 2026
Microsoft said multiple Windows zero-day vulnerabilities were publicly disclosed without prior coordination, exposing customers before patches or mitigations were ready. The company identified the flaws as **RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma**, affecting components including **Microsoft Defender** and **BitLocker**, and said the releases undermined Coordinated Vulnerability Disclosure practices by giving attackers technical details and proof-of-concept material to weaponize. Microsoft said its security teams are assessing impact, developing updates, and continuing to accept reports through the Microsoft Security Response Center. The disclosures were tied to researcher **Chaotic Eclipse**, also known as **Nightmare-Eclipse**, whose GitHub account was reportedly removed and whose GitLab account was later suspended after exploit tools were mirrored across platforms. Reports said **BlueHammer** (`CVE-2026-33825`) was patched in April and added to CISA’s Known Exploited Vulnerabilities catalog, while **RedSun** and **UnDefend** remained unpatched as of late May; Microsoft and outside researchers said **BlueHammer, RedSun, and UnDefend** were already being exploited in the wild, including in intrusions that began with compromised FortiGate VPN credentials and escalated through Defender flaws. The researcher has accused Microsoft of mishandling earlier communications and threatened another public release, deepening the dispute over vendor coordination and platform enforcement.
Jun 29, 2026