Full Report
Huntress observed in-the-wild use of Nightmare-Eclipse tooling, including BlueHammer, RedSun, and UnDefend, in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands, and likely tunneling activity.
Analysis Summary
# Tool/Technique: Nightmare-Eclipse Tooling (BlueHammer, RedSun, UnDefend)
## Overview
Nightmare-Eclipse refers to a suite of exploitation tools and techniques originally released as public Proof-of-Concept (PoC) code by a security researcher. These tools leverage flaws in Windows Defender and the Windows operating system to achieve Local Privilege Escalation (LPE) and bypass security features. Huntress observed these tools being transitioned from theoretical research to active use in real-world intrusions, specifically targeting environments following FortiGate VPN compromises.
## Technical Details
- **Type:** Malware / Exploit Tooling (Privilege Escalation & Defense Evasion)
- **Platform:** Windows (Specifically targeting systems with Windows Defender active)
- **Capabilities:** Local Privilege Escalation (LPE) to SYSTEM, Defense Evasion, Oplock manipulation, Race condition exploitation (TOCTOU).
- **First Seen:** Public PoCs emerged late 2025/early 2026; In-the-wild activity observed mid-April 2026.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1133 - External Remote Services] (FortiGate SSL VPN compromise)
- **[TA0004 - Privilege Escalation]**
- [T1068 - Exploitation for Privilege Escalation] (BlueHammer/RedSun)
- **[TA0005 - Defense Evasion]**
- [T1562.001 - Impair Defenses: Disable or Modify Tools] (UnDefend)
- **[TA0007 - Discovery]**
- [T1033 - System Owner/User Discovery] (whoami /priv)
- [T1069 - Permission Groups Discovery] (net group)
- **[TA0011 - Command and Control]**
- [T1572 - Protocol Tunneling] (BeigeBurrow/agent.exe)
## Functionality
### Core Capabilities
* **BlueHammer (CVE-2026-33825):** Exploits a Time Of Check, Time Of Use (TOCTOU) race condition in Windows Defender's remediation process to escalate privileges from a standard user to SYSTEM.
* **RedSun:** A similar LPE technique using Opportunistic Locks (oplocks) to hold files open, allowing the attacker to intercept or manipulate Defender’s file-scanning operations to trigger privilege elevation.
* **UnDefend:** A tool designed to bypass or disable Windows Defender features, hindering the system's ability to detect and remediate malicious files.
### Advanced Features
* **Oplock Orchestration:** Uses file system locks to time exploitation perfectly against the real-time scanning engine of the EDR/AV.
* **BeigeBurrow (agent.exe):** A custom or modified binary used post-exploitation to establish an encrypted tunnel for persistent C2 and follow-on access.
## Indicators of Compromise
* **File Names:**
* `agent.exe` (Dubbed "BeigeBurrow")
* `BlueHammer.exe` / `RedSun.exe` / `UnDefend.exe` (or variations)
* **Staging Paths:**
* `C:\Users\<user>\Pictures\`
* `C:\Users\<user>\Downloads\<short_subfolder>\`
* **Network Indicators:**
* Suspicious FortiGate VPN logins from Russian-based IP addresses [defanged: 185[.]xxx[.]xxx[.]xxx].
* C2 tunneling traffic via `agent.exe`.
* **Behavioral Indicators:**
* Rapid succession of: `whoami /priv`, `cmdkey /list`, and `net group`.
* Unusual file locking (oplock) activity on sensitive system directories.
## Associated Threat Actors
* **Chaotic Eclipse / Nightmare-Eclipse:** (Original researcher/alias).
* **Unidentified Threat Actor:** Observed using these tools in conjunction with FortiGate VPN exploits, possibly linked to Russian-based infrastructure.
## Detection Methods
* **Signature-based:** Monitoring for the specific file hashes of the public Nightmare-Eclipse PoCs and the `BeigeBurrow` agent.
* **Behavioral detection:**
* Alerting on `whoami /priv` or `net group` executed immediately following a VPN login from a new IP.
* Monitoring for frequent `Access Denied` or file-sharing violations in Windows Defender logs (potential signs of BlueHammer/RedSun race conditions).
* **YARA:** Target the unique strings and Oplock API calls within the Nightmare-Eclipse binaries.
## Mitigation Strategies
* **Patch Management:** Immediately apply Microsoft’s April 2026 updates (specifically for CVE-2026-33825).
* **VPN Hardening:** Enforce Multi-Factor Authentication (MFA) on all FortiGate SSL VPN accounts and restrict access by geographic location if applicable.
* **Endpoint Security:** Ensure Windows Defender is updated to the latest definitions; however, note that these tools are specifically designed to bypass it, so secondary EDR solutions are recommended.
* **Principle of Least Privilege:** Restrict user permissions to prevent the initial execution of LPE tools.
## Related Tools/Techniques
* **BeigeBurrow:** The tunneling agent used in tandem with the suite.
* **Living off the Land (LotL):** The use of `cmdkey` and `net` commands for reconnaissance.
* **Kawalocker:** Mentioned as part of the broader threat landscape involving novel LPE techniques.