Chaotic Eclipse
Also known as INFINITE NIGHTMARE, MSNightmare, Nightmare-Eclipse
Reports
3
First seen
May 14, 2026
Last seen
Aug 12, 2026
Motivation
Notoriety
Relationships
Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.
Targeting
Sectors
Victim regions
United States ×1
Top ATT&CK techniques
T1068 Exploitation for Privilege Escalation ×2T1598.003 Phishing for Information: Spearphishing Link ×1T1133 External Remote Services ×1T1566 Phishing ×1T1566.003 Phishing: Spearphishing via Service ×1T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools ×1T1219 Remote Access Software ×1T1059.001 Command and Scripting Interpreter: PowerShell ×1T1542.005 Bootkit ×1T1190 Exploit Public-Facing Application ×1T1566.002 Phishing: Spearphishing Link ×1T1486 Data Encrypted for Impact ×1
Indicators
cve ×93filename ×5domain ×4ip_v4 ×1
Indicator values are available on Pro and via the API.
Associated CVEs
CVE-2025-48804 (exploited)CVE-2026-26980 (exploited)CVE-2026-27771CVE-2026-33825 (exploited)CVE-2026-42897 (exploited)CVE-2026-42945 (exploited)CVE-2026-50656 (exploited)CVE-2026-51296CVE-2026-51297CVE-2026-51300CVE-2026-51302CVE-2026-51303CVE-2026-62832CVE-2026-66066 (exploited)CVE-2026-68820 (exploited)CVE-2026-72971
Recent reports
High