Nightmare Eclipse

☆ pin

Also known as Nightmare-Eclipse, Chaotic Eclipse

Reports

First seen

Apr 17, 2026

Last seen

Jun 10, 2026

Motivation

Hacktivism

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Top ATT&CK techniques

T1068 Exploitation for Privilege Escalation ×4T1486 Data Encrypted for Impact ×2T1087 Account Discovery ×2T1190 Exploit Public-Facing Application ×2T1021.001 Remote Services: Remote Desktop Protocol ×1T1562 Impair Defenses ×1T1018 Remote System Discovery ×1T1219 Remote Access Software ×1T1542 Pre-OS Boot ×1T1498 Network Denial of Service ×1T1027 Obfuscated Files or Information ×1T1090 Proxy ×1

Indicators

cve ×159filename ×11ip_v4 ×3hash_sha256 ×1domain ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-50507 (exploited)CVE-2026-45586 (exploited)CVE-2026-33825 (exploited)CVE-2026-49160 (exploited)CVE-2026-41091 (exploited)CVE-2026-45657 CVE-2026-45658 CVE-2026-45500 CVE-2026-45585 (exploited)

Recent reports

Critical

Nightmare Eclipse

Relationships

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Microsoft ships largest Patch Tuesday on record with one vulnerability under active attack

Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges on Windows 10/11

Microsoft's Record-Breaking June 2026 Patch Tuesday: 200 Vulnerabilities Including Critical Zero-Days

Microsoft June 2026 Patch Tuesday fixes 5 zero-days, 200 flaws

Microsoft condemns uncoordinated zero-day releases by Nightmare Eclipse researcher

Microsoft shares mitigation for YellowKey Windows zero-day

Nightmare-Eclipse Tooling Observed in Real-World Intrusion Campaign

Attackers Love Your VPN To-Do List