Executive Summary
Nightmare Eclipse (also known as Dead Eclipse or Chaotic Eclipse) has released a seventh zero-day exploit, dubbed 'RoguePlanet,' as part of a retaliatory campaign against Microsoft. RoguePlanet targets a design-level Time-of-Check to Time-of-Use (TOCTOU) race condition in the Microsoft Malware Protection Engine (MsMpEng.exe). Successful exploitation allows an unprivileged user to execute arbitrary code with SYSTEM integrity, potentially leading to full system compromise.
The attack chain weaponizes Defender's scanning and quarantine pipeline using NTFS junctions, opportunistic locks (oplocks), and the Windows Error Reporting (WER) QueueReporting scheduled task. While originally conceived as a Remote Code Execution (RCE) via SMB shares, the current public iteration functions as a Local Privilege Escalation (LPE). This disclosure occurred immediately following the June 2026 Patch Tuesday, specifically bypassing silent hardening measures Microsoft implemented in mid-May 2026. Prior exploits from this actor, such as BlueHammer and RedSun, have already been observed in active real-world intrusions.
Key Details
Threat Name
RoguePlanet
Affects
Microsoft Defender, Microsoft Malware Protection Engine, BitLocker (WinRE), CTFMON (Windows), Windows (Cloud Files Mini Filter Driver), Splunk, NGINX, cPanel, WHM, Linux Kernel, Citrix NetScaler, Fortinet FortiClient EMS, Windows
Adversary
Nightmare Eclipse Other Adversaries and Aliases: Nightmare-Eclipse
MITRE Techniques
Malware/Tools
RoguePlanet, BlueHammer, YellowKey, RedSun, GreenPlasma, UnDefend, MiniPlasma, Mini Shai-Hulud, MedusaLocker