Full Report
In our previous blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.
Analysis Summary
# Threat Actor: Nightmare-Eclipse
## Attribution & Identity
**Nightmare-Eclipse** is a leak persona characterized as a sophisticated threat actor or group focused on the disclosure of high-quality Proof of Concept (PoC) exploits and research. The actor demonstrates deep internal knowledge of the Microsoft Windows ecosystem and popular security software architectures. There is no definitive attribution to a specific nation-state or established group in the provided text, though their work shows a high level of technical proficiency typical of advanced persistent threats (APTs).
## Activity Summary
The actor has recently released a series of disclosures and PoCs aimed at expanding the attack surface of enterprise environments. Recent operations include:
* **HardBreacher:** A technique targeting Kaspersky Endpoint Security to achieve DLL sideloading and defense evasion.
* **PrettyPrague, GreenSection, and FalconFlank:** Additional PoCs (details partially truncated in text) targeting Microsoft ecosystem components including Windows Defender and Cloud Files.
* **Leak Campaigns:** Systematic disclosure of vulnerabilities involving Windows kernel namespace manipulation and trusted process hijacking.
## Tactics, Techniques & Procedures
The actor specializes in abusing "trusted" boundaries and legitimate OS functionality to bypass security controls.
* **Session-Namespace Hijacking:** Creating symbolic links in `\Sessions\0\DosDevices\` to shadow the global device namespace and redirect file paths (e.g., shadowing the C: drive).
* **Parent PID (PPID) Spoofing:** Using the native `NtCreateUserProcess` with the `PS_ATTRIBUTE_PARENT_PROCESS` attribute to make malicious processes appear as children of legitimate ones like `explorer.exe`.
* **DLL Sideloading/Hijacking:** Ambushing security software (like Kaspersky’s `avpui.exe`) by redirecting the OS loader to malicious payloads (`SolidSnake.dll`) during process initialization.
* **Defense Evasion:** Hiding security software UI notifications by programmatically monitoring window titles and killing processes from within.
* **NTFS Hardlinking:** Using hardlinks to point multiple filenames (e.g., a JPG and a DLL) to the same inode to bypass file scanners.
**MITRE ATT&CK IDs:**
* **T1574.002:** Hijack Execution Flow: DLL Side-Loading
* **T1135:** IP Address/Domain Spoofing (applied here to Process/Namespace spoofing)
* **T1564:** Hide Artifacts
* **T1134.004:** Access Token Manipulation: Parent PID Spoofing
## Targeting
* **Sectors:** Enterprise environments, Managed Security Service Providers (MSSPs), and organizations utilizing high-privilege security software.
* **Geography:** Global (implied by the targeting of international software like Kaspersky and Microsoft).
* **Victims:** Users of Microsoft Windows ecosystem (Cloud Files, Windows Defender) and Kaspersky Endpoint Security.
## Tools & Infrastructure
* **Malware/Payloads:**
* `SolidSnake.dll`: A payload used for internal process manipulation and defense evasion.
* **PoCs/Tools:**
* `HardBreacher.exe`: The primary loader for the Kaspersky exploit.
* `mrkaspy.jpg`: A bait file used in conjunction with NTFS hardlinks.
* **Infrastructure:** The actor primarily operates through "leak persona" platforms. Specific C2 infrastructure was not detailed in this disclosure.
* *Defanged URL associated with report:* hxxps[:]//21158977[.]fs1[.]hubspotusercontent-na1[.]net/hubfs/...
## Implications
Nightmare-Eclipse represents a significant threat to the integrity of "trusted" security stacks. By weaponizing the very tools meant to protect the enterprise (Antivirus and EDR), they create a "blind spot" where security telemetry becomes unreliable. Their ability to manipulate the Windows kernel namespace suggests a shift toward exploits that do not rely on traditional software "bugs" but rather on the architectural design of the operating system itself.
## Mitigations
* **EDR Enrichment:** Look beyond simple parent-child relationships; monitor for `NtCreateUserProcess` calls that originate from unexpected memory regions or use unusual attributes.
* **Namespace Monitoring:** Implement detections for the creation of symbolic links within session-specific `DosDevices` directories, especially those shadowing drive letters (C:, D:, etc.).
* **Rapid Patching:** Prioritize updates for security software and core OS components, as the actor targets vulnerabilities that are often addressed through rapid remediation cycles.
* **Integrity Checks:** Employ code signing enforcement and strictly monitor for unsigned or unexpectedly signed DLLs loading into high-privilege security processes.