Overview Security researchers have confirmed the first in‑the‑wild use of Nightmare‑Eclipse privilege escalation tools — BlueHammer, RedSun, and UnDefend — following unauthorized access through a compromised FortiGate SSL VPN. While privilege escalation attempts largely failed, attackers successfully deployed a covert tunneling tool named BeigeBurrow, raising alarms for enterprise defenders.
Key Highlights
- Entry Point: Compromised FortiGate SSL VPN credentials used from multiple geographies (Russia, Singapore, Switzerland).
- Privilege Escalation Tools:
- BlueHammer (patched April 2026, CVE‑2026‑33825).
- RedSun and UnDefend (unpatched zero‑days).
- Execution Evidence: Binaries like FunnyApp.exe, RedSun.exe, and undef.exe staged in user directories.
- Operator Inexperience: Misuse of flags (e.g., “‑agressive”) suggested limited familiarity with tooling.
- Successful Component: BeigeBurrow, a Go‑compiled agent using Yamux multiplexing, established persistent covert TCP relays over port 443.
Attack Flow
- VPN Compromise: Valid credentials abused to access FortiGate SSL VPN.
- Tool Deployment: Nightmare‑Eclipse binaries executed from user‑writable paths.
- Privilege Escalation Attempts: Failed to extract SAM credentials or overwrite system files.
- Persistence & C2: BeigeBurrow connected outbound to
staybud.dpdns[.]org, bypassing firewall restrictions. - Hands‑On Activity: Post‑exploitation commands (
whoami /priv,cmdkey /list,net group) confirmed live operator presence.
Risks to Enterprises
- Zero‑Day Exposure: RedSun and UnDefend remain unpatched, exploitable on fully updated Windows systems.
- Credential Abuse: VPN accounts accessed from multiple countries suggest resale/sharing.
- Covert Persistence: BeigeBurrow’s use of Yamux over port 443 makes detection difficult.
- Operational Threat: Even failed privilege escalation attempts show adversaries experimenting actively in live environments.
Mitigation Guidance
- Patch Immediately: Apply April 2026 updates to remediate CVE‑2026‑33825 (BlueHammer).
- Hunt for Artifacts: Inspect user directories (Pictures, Downloads) for binaries like FunnyApp.exe, RedSun.exe, undef.exe.
- Review VPN Logs: Flag accounts authenticating from multiple countries in short timeframes.
- Block C2 Domains: Monitor and block
staybud.dpdns[.]organd related tunneling behavior. - Detect Enumeration: Alert on suspicious privilege checks and credential listing commands.
- Use YARA Rules: Community‑published BeigeBurrow detection rules should be deployed across endpoints.
Final Thought
This incident illustrates how publicly released privilege escalation tools can quickly migrate from proof‑of‑concept to real‑world exploitation. Even when privilege escalation fails, attackers can pivot to persistence and tunneling, as seen with BeigeBurrow. For defenders, the takeaway is clear: patch rapidly, monitor VPN access closely, and hunt for covert relay activity to stay ahead of adversaries experimenting with Nightmare‑Eclipse tooling.
Leave a Reply