Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows

1. Executive summary

A threat actor using the alias "Nightmare Eclipse" (also known as Chaotic Eclipse, INFINITE NIGHTMARE, MSNightmare) has published a proof-of-concept (PoC) exploit dubbed "ShieldBreak," which grants NT AUTHORITY\SYSTEM privileges on fully patched Windows 10, Windows 11, and Windows Server systems. The exploit is a local privilege-escalation (LPE) vulnerability in Microsoft Defender that bypasses the patch for a prior flaw, CVE-2026-50656 (CVSS 7.8 HIGH, EPSS 11%, not in CISA KEV), which Microsoft addressed in July via the Microsoft Malware Protection Engine. Attribution to a specific individual is unconfirmed; the actor claims to be a former disgruntled Microsoft employee. EMEA financial services running Microsoft Defender on endpoints or servers face an elevated risk of complete system compromise by authenticated, low-privileged attackers until Microsoft releases a dedicated fix.

2. Regulatory framing

3. Technical analysis & attack chain

ShieldBreak is a local privilege-escalation exploit targeting Microsoft Defender on fully patched Windows systems. It is the tenth zero-day released by the actor since April 2026. The actor claims the PoC has a 100% success rate on Windows 11 25H2 (including Canary channel) and Windows Server 2025, noting that while Windows 10 and corresponding server editions are also vulnerable, they are not currently supported by the PoC code.

The attack chain operates as follows:

1. Initial Access & Positioning: An attacker must possess an authenticated, low-privileged session on a target Windows system where Microsoft Defender's real-time protection is active.
2. Exploit Execution: The attacker executes the ShieldBreak PoC. The mechanism differs from the earlier RoguePlanet exploit. While RoguePlanet (CVE-2026-50656) was a filesystem race condition using virtual disks and NT native file manipulation to trick the quarantine process into overwriting system files, ShieldBreak operates by abusing the Cloud Filter API (cfapi).
3. Mechanism: ShieldBreak uses a user-mode callback hook to alter file contents during a Defender "cloud-hydration scan" via cfapi.
4. Privilege Escalation: The exploit successfully elevates the attacker's privileges from a standard user context to NT AUTHORITY\SYSTEM, granting complete control of the local machine.

Discrepancy Note: The verified reference data classifies CVE-2026-50656 (the patched vulnerability ShieldBreak bypasses) under CWE-59 (Improper Link Resolution Before File Access). Source reporting corroborates this by describing the original RoguePlanet flaw as an improper link resolution/race condition in file handling.

Attribution Caveat: Attribution to "Nightmare Eclipse" is based on the actor's own public claims. The actor has no MITRE ATT&CK profile in the verified reference data; treat attribution as unconfirmed. The claim that the actor is a former Microsoft employee is single-sourced from the actor's statements and should not be treated as verified intelligence.

4. Mitigation & containment

P1 — Within 24 hours: Threat Hunting & Detection

• Deploy hunting queries published by researcher Kevin Beaumont to identify stealthy ShieldBreak execution in your environment. (Specific queries are referenced in The Register's reporting; obtain them from the source URL).
• Audit systems running Windows 11 25H2 and Windows Server 2025 for unexpected SYSTEM-level process spawning from standard user contexts, particularly those involving MsMpEng.exe or cfapi.dll.

P2 — Within 72 hours: Endpoint Hardening & Validation

• Verify that the Microsoft Malware Protection Engine is updated to version 1.1.26060.3008 or later. While this version patched the original RoguePlanet (CVE-2026-50656) flaw, it does not fix ShieldBreak; however, ensuring the engine is current prevents exploitation via the older vector.
• If Defender is not the primary AV (e.g., a third-party AV is active and Defender is disabled), confirm that the Defender scanning engine is not running, as this mitigates the specific cfapi attack vector.

P3 — Within 7 days: Process & Monitoring Updates

• Monitor Microsoft security advisories for the release of a patch specifically addressing the ShieldBreak cfapi bypass mechanism.
• Restrict interactive logon access for low-privileged service accounts on critical Windows Server 2025 assets where feasible, as the exploit requires local execution.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

7 referenced CVEs — 3 actively exploited (CISA KEV)

7. Sources

• The Register — Microsoft-vendetta hacker has a new zero day that gives system privileges on fully patched Windows — https://www.theregister.com/security/2026/08/12/microsoft-vendetta-hacker-has-a-new-zero-day-that-gives-system-privileges-on-fully-patched-windows/5286889 — 2026-08-12
• The Hacker News — ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access — https://thehackernews.com/2026/08/shieldbreak-zero-day-poc-claims.html — 2026-08-12
• The Register — Microsoft closes book on Nightmare Eclipse's RoguePlanet zero-day — https://www.theregister.com/security/2026/07/09/microsoft-closes-book-on-nightmare-eclipses-rogueplanet-zero-day/5269280 — 2026-07-09
• Help Net Security — Microsoft working on patch for RoguePlanet Defender zero-day (CVE-2026-50656) — https://www.helpnetsecurity.com/2026/06/17/rogueplanet-zero-day-cve-2026-50656/ — 2026-06-17
• Malwarebytes Labs — Microsoft fixes RoguePlanet zero-day in Defender — https://www.malwarebytes.com/blog/news/2026/07/microsoft-fixes-rogueplanet-zero-day-in-defender — 2026-07-09

8. Adverse Trace position

ShieldBreak represents a high-severity local privilege-escalation risk (CVSS 7.8 HIGH for the underlying bypassed CVE-2026-50656) for EMEA financial services heavily invested in the Microsoft ecosystem, particularly those running Windows 11 25H2 and Windows Server 2025. The exploit's ability to bypass a recent patch via a novel cfapi mechanism underscores the persistent risk from this single actor's campaign. Attribution to "Nightmare Eclipse" remains unconfirmed without a MITRE profile, and the actor's motivation appears retaliatory against Microsoft. We will monitor Microsoft's patch release cycle for a specific fix to the Cloud Filter API abuse vector and update clients with corresponding detection logic as it becomes available.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.