Loading story…
Security researcher NightmareEclipse/Chaotic Eclipse publicly released a proof-of-concept exploit for a Windows local elevation-of-privilege zero-day dubbed LegacyHive, targeting the Windows User Profile Service (ProfSvc). The flaw abuses arbitrary registry hive loading to let a standard user mount another user’s registry hive—particularly usrclass.dat—under their own registry classes root, potentially exposing sensitive registry data and enabling privileged read-write access that could support further escalation. Reports said the public PoC was intentionally limited and may require additional user credentials, while the researcher claimed the original technique could load arbitrary hives without that restriction.
The disclosure said the issue affects fully patched supported Windows desktop and server versions, including systems updated through July 2026, and no CVE, Microsoft advisory, or official patch had been identified at the time of publication. Researchers and defenders warned that, although the released PoC does not by itself guarantee full system compromise, it provides a strong post-compromise primitive that skilled attackers could weaponize quickly, especially given prior rapid criminal adoption of the researcher’s earlier Microsoft disclosures. Background documentation on Windows registry hives shows that user profile hives store application settings, desktop configuration, environment data, network connections, and other per-user information, underscoring the sensitivity of unauthorized hive access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
0patch announced free micropatches for the LegacyHive Windows User Profile Service elevation-of-privilege zero-day. This introduced a new third-party mitigation while Microsoft was still investigating the issue.
Microsoft said it is investigating the reported LegacyHive/User Profile Service local privilege-escalation vulnerability. At the time of the statement, no CVE or dedicated security bulletin had been assigned, despite claims that fully patched supported Windows systems were affected.
Kevin Beaumont published Microsoft Defender for Endpoint detection queries to help identify LegacyHive exploitation activity. The queries were released after public disclosure of the LegacyHive Windows privilege-escalation PoC.
Security researcher NightmareEclipse/Chaotic Eclipse publicly released a proof-of-concept exploit named LegacyHive for a Windows User Profile Service local elevation-of-privilege issue involving arbitrary registry hive loading. The disclosure said the public PoC was intentionally limited, while a more capable version could load arbitrary hives and reportedly worked on supported Windows systems even after July 2026 updates.
A GitHub repository for the LegacyHive proof-of-concept was published, describing a Windows User Profile Service local privilege-escalation issue involving arbitrary registry hive loading. The repository said the public PoC was intentionally limited, while claiming a more capable version affected supported Windows desktop and server systems even after July 2026 patching.
Microsoft published documentation describing Windows Registry hive structure, backing files, and how user profile hives are loaded and stored in Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
0patch.com
Open sourcelevelblue.com
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourcegithub.com
Open sourcegit.projectnightcrawler.dev
Open sourceblog.projectnightcrawler.dev
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A public proof-of-concept exploit dubbed **MiniPlasma** has been released for a Windows local privilege escalation flaw that can grant attackers **SYSTEM** access on fully patched machines. The exploit targets `cldflt.sys`, the Windows Cloud Files Mini Filter Driver used by cloud sync features such as OneDrive, and specifically abuses the `HsmOsBlockPlaceholderAccess` routine. Researchers said the bug appears tied to **`CVE-2020-17103`**, a vulnerability originally reported by Google Project Zero's James Forshaw in 2020 and believed to have been fixed by Microsoft, but the original exploit path reportedly still works. The exploit abuses missing access checks and a race condition during token switching to create arbitrary registry keys in the `.DEFAULT` user hive and ultimately spawn a SYSTEM shell. Researcher Chaotic Eclipse, also referenced as Nightmare-Eclipse, published the code on GitHub, while Will Dormann reported that it works reliably on Windows 11 systems with the May 2026 updates, though not on the latest Insider Preview Canary builds. Because the affected driver is broadly deployed across Windows environments, the release of reliable public exploit code sharply raises near-term risk while organizations await clarification or a fix from Microsoft.
Jul 1, 2026
A proof-of-concept exploit for a new Microsoft Defender local privilege escalation flaw dubbed **RedSun** was published by researcher **Chaotic Eclipse**, with reports saying it works on fully patched **Windows 10**, **Windows 11**, and **Windows Server 2019 and later** when Defender is enabled. The zero-day allows an unprivileged local user to gain **SYSTEM** privileges by abusing Defender’s handling of files tagged by cloud detection, and Microsoft had not released a patch at the time of reporting. Independent researcher **Will Dormann** reportedly validated the exploit chain, which uses the **Windows Cloud Files API**, opportunistic locks, and **NTFS junctions/reparse points** to redirect Defender into overwriting a protected binary under `C:\Windows\System32` and then executing it as SYSTEM. The disclosure followed an earlier Defender privilege-escalation exploit, **BlueHammer**, which Microsoft patched as `CVE-2026-33825`, while defenders were urged to watch for anomalous Defender file writes, `cldapi.dll` activity, and oplock-assisted redirection behavior pending a vendor fix.
Jun 29, 2026
Praetorian publicly released **Swarmer**, a Windows persistence tool that enables **low-privilege** attackers to establish startup execution while **evading EDR visibility** by avoiding standard registry-write APIs. The technique abuses **mandatory user profiles** by creating a `NTUSER.MAN` hive (derived from `NTUSER.DAT`) that overrides the normal per-user registry hive at next logon; because the modified hive is not loaded until the user signs in again, EDR products that rely on monitoring live registry modifications (e.g., hooks on `RegSetValue*` and related telemetry) may not observe the persistence being set. Swarmer achieves this by using Microsoft’s **Offline Registry Library** (`offreg.dll`) to build and modify registry hives “offline” (e.g., via functions such as `OROpenHive`, `ORCreateKey`, `ORSetValue`, and `ORSaveHive`) rather than calling the typical `Reg*` APIs that many EDRs instrument. Reported operator workflow includes exporting `HKCU`, adding a startup entry (commonly under `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run`), generating a modified `NTUSER.MAN`, and placing it in `%USERPROFILE%` so the persistence activates on the next login; the Reddit post links to the same research/tool release and reiterates the core evasion premise (no observable registry writes at the time persistence is staged).
Jun 29, 2026