Loading story…
NightmareEclipse released ShieldBreak, a proof-of-concept local privilege-escalation exploit claimed to bypass Microsoft’s fix for CVE-2026-50656 (RoguePlanet). The exploit allegedly abuses improper link resolution during Windows Defender remediation, combining Cloud Files placeholders, Object Manager symbolic-link swaps, CLFS path handling, an EICAR-triggered scan, and NTFS alternate data streams to redirect a Defender process running as SYSTEM and plant C:\Windows\System32\phoneinfo.dll. A fabricated Windows Error Reporting report and the QueueReporting scheduled task then cause wermgr.exe to load the malicious DLL; the included Warden.dll payload reportedly duplicates a SYSTEM token and opens a SYSTEM shell in the unprivileged user’s session.
Splunk published attack data and multiple disabled-by-default analytics for the ShieldBreak chain, covering Defender activity on \globalroot\ object-manager paths (Defender Operational events 1116/1117), MpClient.dll loaded by non-Defender processes, ADS creation through loopback administrative SMB shares (Security event 5145), manually created .wer files in the Windows Error Reporting ReportQueue, creation of phantom DLLs such as phoneinfo.dll in system paths, and WerMgr.exe spawning SYSTEM-integrity children. Organizations should collect the required Sysmon, Security, and Defender Operational telemetry; enable file-share object-access auditing; investigate these signals promptly; and validate the creating process, signer, file hash, and operational need before suppressing alerts.
See real exploitation activity before you spend the cycle.
7 events from the most recent confirmed update back to the earliest known activity.
Splunk updated its "Windows Phantom DLL Created on Disk" analytic, which monitors suspicious phantom DLL creation or modification in Windows system paths, including ShieldBreak's phoneinfo.dll artifact.
Splunk published the "Windows Defender MpClient.dll Loaded by Non-Defender Process" anomaly detection to identify ShieldBreak-associated loading of the Defender client API library by non-Defender processes.
Splunk published the "Windows Defender Threat Detected on Kernel Object Path" analytic, which identifies Defender detection or remediation events involving paths containing \globalroot\ and is intended to detect ShieldBreak-related activity.
Splunk authored version 1.0 of its ShieldBreak dataset to support simulated Windows Defender exploitation detection, including Sysmon, Defender Operational, and Windows Security telemetry.
Microsoft reportedly patched RoguePlanet, tracked as CVE-2026-50656, which involved improper link resolution during Windows Defender remediation.
APT19 conducted a watering-hole attack on forbes.com to compromise targets.
NightmareEclipse released ShieldBreak, a proof-of-concept exploit claimed to bypass the RoguePlanet patch and obtain a SYSTEM shell by redirecting a privileged Defender write and abusing Windows Error Reporting.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
11 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourceresearch.splunk.com
Open sourcethreatlocker.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A publicly disclosed zero-day dubbed **ShieldBreak** (`CVE-2026-69414`) allows a local attacker with limited privileges to escalate to **SYSTEM** on Windows systems where Microsoft Defender is enabled. Reporting says the flaw affects the **Microsoft Malware Protection Engine** and serves as a bypass of Microsoft’s earlier fix for **RoguePlanet** (`CVE-2026-50656`), indicating the prior remediation was incomplete. Microsoft has acknowledged the issue and said it is working on a patch, but no release date has been announced. Technical analysis shows the exploit chains **Cloud Files** abuse, **NT Object Manager** namespace manipulation, direct use of Defender functionality through `MpClient.dll`, a remediation timing race, and **Windows Error Reporting** task abuse to coerce Defender into writing an attacker-controlled DLL to `C:\Windows\System32\phoneinfo.dll`, which is then executed by `wermgr.exe` as SYSTEM. Researchers reproduced the proof of concept on fully patched **Windows 11 24H2** and **Windows Server 2025** systems with default Defender settings, with elevation reportedly occurring in roughly eight to twelve seconds; key detection opportunities include creation of `phoneinfo.dll` in `System32`, `MpClient.dll` loading by non-Defender processes, suspicious activity under `\BaseNamedObjects\Restricted\`, and `wermgr.exe` loading the planted DLL.
Aug 20, 2026
Security researcher **Chaotic Eclipse** has released a proof-of-concept exploit dubbed **ShieldBreak** that allegedly bypasses Microsoft’s fix for `CVE-2026-50656`, also known as **RoguePlanet**, in **Microsoft Defender for Windows**. The flaw affects the **Microsoft Malware Protection Engine** and has been described as a local privilege escalation race condition that can let an attacker with local access spawn a **SYSTEM-level shell** and execute arbitrary code. The researcher said the bypass works reliably on **Windows 11 25H2** and **Windows Server 2025**, and that **Windows 10** is also believed to be vulnerable. Microsoft had issued updates for the RoguePlanet zero-day after acknowledging it earlier, but the new claims suggest the patch was incomplete. The disclosure adds to ongoing scrutiny of Microsoft’s recent security fixes and follows earlier public zero-day releases by the same researcher, including **LegacyHive**, amid a broader dispute over coordinated vulnerability disclosure. Separate reporting also noted that Microsoft recently patched hundreds of flaws and that **CISA** added `CVE-2026-68820`, an actively exploited WinSock driver issue, to its **Known Exploited Vulnerabilities** catalog with a remediation deadline for U.S. federal agencies.
Aug 17, 2026
A researcher using the names Nightmare Eclipse and Chaotic Eclipse released **ShieldCrash**, a proof of concept said to bypass aspects of Microsoft’s remediation for the Microsoft Defender elevation-of-privilege flaw `CVE-2026-69414`, also called ShieldBreak. The researcher claims the exploit works on fully patched Windows 10, Windows 11, and Windows Server systems, including systems with September 2026 updates, to perform arbitrary file reads under `SYSTEM` privileges. Microsoft had said Malware Protection Engine version `1.1.26080.3`, delivered through automatic engine and malware-definition updates, fixed ShieldBreak. The claimed bypass has not been independently verified, and available reporting indicates ShieldCrash demonstrates `SYSTEM`-level file-read access rather than arbitrary writes or a complete SYSTEM compromise; the release occurred amid a dispute over Microsoft’s bug-bounty and vulnerability-disclosure practices.
Sep 10, 2026