Nightmare-Eclipse PoCs Abuse Security Software and Trusted Windows Components
Summary
LevelBlue analyzes four Nightmare-Eclipse PoCs targeting Kaspersky, Avast, NVIDIA, and CrowdStrike, detailing their techniques, impacts, detection opportunities, and remediation status.
Key points
- HardBreacher uses session-specific symbolic-link redirection and parent-process spoofing to load a payload through Kaspersky's UI process and suppress its notification window.
- PrettyPrague abuses Avast's sandbox driver to access a virtualized SAM hive, extract local NTLM hashes, and obtain SYSTEM access; the exploit temporarily changes administrator passwords and restores them.
- GreenSection shows that a standard user can modify an NVIDIA global shared-memory section, but the PoC does not demonstrate privilege escalation or code execution.
- FalconFlank uses filesystem reparse-point techniques to pursue local privilege escalation through CrowdStrike's macro-removal workflow; exposure depends on that policy setting being enabled.
- LevelBlue reports that CrowdStrike detected and quarantined a staged DLL during testing, preventing the PoC from reaching its final stage.
- The article recommends behavior-focused hunting for unusual driver access, namespace manipulation, SAM access, privileged process activity, and reparse-point use.
- The authors characterize PrettyPrague as the most consequential PoC before remediation and note that delayed security-product updates can leave systems exposed.
Article Details
- Attack Vectors
- HardBreacher redirects the Kaspersky UI process's session-specific C: namespace to a fake filesystem tree and loads a payload DLL from %TEMP% during startup.
- HardBreacher creates avpui.exe with explorer.exe as its recorded parent using NtCreateUserProcess and PS_ATTRIBUTE_PARENT_PROCESS.
- PrettyPrague sends IOCTL 0x82AC0054 to Avast's aswSnx driver to run its executable in Avast's sandbox, then races to access and copy the virtualized SAM hive.
- PrettyPrague extracts local NTLM password hashes from the sandboxed SAM, temporarily changes local administrator passwords, and uses a UAC bypass involving the CMLuaUtil COM interface to obtain a SYSTEM shell.
- GreenSection opens and modifies an NVIDIA global shared-memory section from a standard user context; the PoC does not demonstrate privilege escalation or code execution.
- FalconFlank uses filesystem reparse points, oplocks, and privileged task execution to pursue local privilege escalation through CrowdStrike Falcon's macro-removal workflow. The article says exposure depends on the relevant prevention-policy setting being enabled.
- Defensive Notes
- Detect avpui.exe loading DLLs from %TEMP%, unexpected parent-process relationships, and namespace manipulation by non-system user processes.
- Monitor non-Avast processes accessing \\.\aswSnx, monitoring the Avast sandbox directory before accessing a SAM hive, or performing unusual SAM account operations.
- Monitor unexpected use of the CMSTPLUA COM object and ICMLuaUtil interface, including DllHost.exe activity associated with the documented CLSID and IID.
- Investigate non-NVIDIA processes opening and modifying NVIDIA global shared-memory sections.
- Hunt for reparse-point, mount-point, or junction creation followed by access to protected Windows locations, and review CrowdStrike Falcon detections involving staged bcrypt.dll files.
- The article reports that Kaspersky detects HardBreacher when the endpoint is online and signature databases are current; offline or delayed-update configurations may not trigger that detection.
- Review CrowdStrike prevention-policy configuration and apply vendor updates; the article says Falcon Government policies do not expose the relevant macro-removal setting.
MITRE ATT&CK
T1003.002 · Security Account ManagerPrettyPrague accesses the virtualized SAM hive and extracts local NTLM password hashes.T1068 · Exploitation for Privilege EscalationFalconFlank is described as a local privilege-escalation PoC using filesystem manipulation and privileged task execution.T1134.004 · Parent PID SpoofingHardBreacher sets PS_ATTRIBUTE_PARENT_PROCESS to make avpui.exe appear to have been spawned by explorer.exe.T1548.002 · Bypass User Account ControlPrettyPrague uses the CMLuaUtil COM interface in a UAC bypass to obtain a SYSTEM shell.T1562.001 · Disable or Modify ToolsHardBreacher hides Kaspersky's notification and terminates avpui.exe, disabling its user-facing notification channel for the session.
Vendors
AvastWhich core technical mechanisms underpin Nightmare-Eclipse's exploits targeting Kaspersky, Avast, NVIDIA, and CrowdStrike software?CrowdStrikeWhich core technical mechanisms underpin Nightmare-Eclipse's exploits targeting Kaspersky, Avast, NVIDIA, and CrowdStrike software?GenDigitalNotably, the actor also claims the vulnerability may affect additional GenDigital products, including AVG and Norton, which share common ownership and portions of their security technology stack.KasperskyWhich core technical mechanisms underpin Nightmare-Eclipse's exploits targeting Kaspersky, Avast, NVIDIA, and CrowdStrike software?Microsoftwe explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.NvidiaWhich core technical mechanisms underpin Nightmare-Eclipse's exploits targeting Kaspersky, Avast, NVIDIA, and CrowdStrike software?
Products
AvastWhich core technical mechanisms underpin Nightmare-Eclipse's exploits targeting Kaspersky, Avast, NVIDIA, and CrowdStrike software?AVGNotably, the actor also claims the vulnerability may affect additional GenDigital products, including AVG and Norton, which share common ownership and portions of their security technology stack.Cloud Filespersona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.CrowdStrike FalconMeanwhile, GreenSection overwrites NVIDIA global shared-memory sections from user space, and FalconFlank manipulates filesystem reparse points to abuse CrowdStrike Falcon macro-removal workflows for privilege escalation.Kaspersky Endpoint SecurityIt enters an EnumWindows loop, waiting for a window titled "Notification from Kaspersky Endpoint Security" to become visible.Microsoft OfficeCrowdStrike Policy setting for Microsoft Office file malicious macro removal enabled alongside CrowdStrike’s policy setting recommendations, which shows that this is an optional setting for “Phase 3 – OptimalMicrosoft Windowsfrom the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.NortonNotably, the actor also claims the vulnerability may affect additional GenDigital products, including AVG and Norton, which share common ownership and portions of their security technology stack.Windows 11Office file malicious macro removal" functionality and was reportedly tested against fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon with Phase 3 Optimal Protection.Windows Defenderfrom the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality.Windows Server 2025macro removal" functionality and was reportedly tested against fully updated Windows 11 25H2 and Windows Server 2025 systems running Falcon with Phase 3 Optimal Protection.
Tools
FalconFlankMeanwhile, GreenSection overwrites NVIDIA global shared-memory sections from user space, and FalconFlank manipulates filesystem reparse points to abuse CrowdStrike Falcon macro-removal workflows for privilege escalation.GreenSectionMeanwhile, GreenSection overwrites NVIDIA global shared-memory sections from user space, and FalconFlank manipulates filesystem reparse points to abuse CrowdStrike Falcon macro-removal workflows for privilege escalation.HardBreacherHardBreacher hijacks Kaspersky's interface loader via DosDevices symbolic links and parent-process spoofing.PrettyPraguePrettyPrague abuses Avast's kernel driver to extract virtualized SAM database credentials.