Executive Summary
In mid-April 2026, threat hunters identified a live intrusion utilizing the recently disclosed Nightmare-Eclipse toolset (BlueHammer, RedSun, and UnDefend). This activity is notable as it marks the transition of these public local privilege escalation (LPE) exploits from proof-of-concept research to active exploitation in the wild. Initial access was likely achieved through compromised FortiGate SSL VPN credentials, with source IPs originating from Russia, Singapore, and Switzerland.
The technical attack chain involved staging malicious binaries in user-writable directories, such as the Pictures and Downloads folders, followed by hands-on-keyboard reconnaissance. BlueHammer (CVE-2026-33825) attempts to abuse race conditions in Windows Defender to read the SAM database, while RedSun targets critical system file overwrites. Persistence and follow-on access were facilitated by a Go-based reverse tunnel agent dubbed BeigeBurrow.
While the observed attempts in this specific case appeared to fail due to operator blunders and rapid isolation, the availability of these unpatched LPE techniques poses a significant risk. Organizations should prioritize patching CVE-2026-33825 and monitoring for the specific indicators and reconnaissance behaviors outlined in this report.