Affected Systems

CrowdStrike Falcon Sensor on Windows 11 25H2 and Windows Server 2025 (all current versions). The vulnerability exploits the Office malicious macros remediation feature.

Exploitation Status

Public proof-of-concept released by researcher Chaotic Eclipse. No CVE assigned yet. CrowdStrike states they are investigating and may already have detections deployed.

Business Impact

Attackers with local access can escalate privileges on endpoints protected by CrowdStrike Falcon. This undermines endpoint security controls and could enable lateral movement or persistence. Organizations using Falcon for endpoint protection should treat this as a critical control bypass. CVSS score not yet published.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Disable the 'Microsoft Office File Suspicious Macro Removal Windows' policy setting in CrowdStrike Falcon immediately per vendor guidance
  • Review the FalconFlank Tech Alert in the CrowdStrike support portal for additional mitigation steps and detection guidance
  • Verify that Cloud Anti-malware for Microsoft Office Files settings remain enabled as compensating control
  • Monitor CrowdStrike Falcon logs for unusual privilege escalation attempts or Office macro remediation activity
  • Apply CrowdStrike updates as soon as a patch is released and test in a staging environment first

---

# Threat Actor Context

Actor Profile

Chaotic Eclipse (also known as INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse) is a security researcher who has gained attention for publicly releasing proof-of-concept exploits for zero-day vulnerabilities in major endpoint security products. The researcher's motivation appears to stem from frustration with vendor response processes, particularly Microsoft's alleged refusal to engage in communication and restrictions on bug reporting. Chaotic Eclipse has stated a desire to "live like a normal human being" and expressed grievances about being portrayed negatively by vendors. The researcher operates by developing and publicly disclosing working PoCs for privilege escalation vulnerabilities, often before vendors have issued patches.

TTPs (Tactics, Techniques, Procedures)

Chaotic Eclipse demonstrates expertise in Windows privilege escalation techniques, specifically targeting endpoint security products. The FalconFlank exploit abuses CrowdStrike Falcon Sensor's office malicious macros remediation feature to achieve privilege escalation (T1068 - Exploitation for Privilege Escalation). The researcher employs DLL loading techniques and has noted that obfuscation (T1027 - Obfuscated Files or Information) may be required to evade detections. Previous work includes exploiting Cloud Files API, TieringEngineService, offline registry hive manipulation, NT Object Manager namespace manipulation, and timing race conditions in remediation paths. The researcher's PoCs target fully updated Windows 11 25H2 and Windows Server 2025 systems, demonstrating capability against current security controls (T1211 - Exploitation for Defense Evasion).

Targets & Patterns

Chaotic Eclipse does not target specific organizations or sectors in a traditional threat actor sense. Instead, the researcher targets major endpoint security vendors and their products, including CrowdStrike Falcon, Kaspersky Endpoint Security, and Microsoft Defender. The pattern suggests a focus on exposing vulnerabilities in widely-deployed security software that protects enterprise environments. The researcher's actions appear motivated by a combination of technical demonstration, frustration with vendor response processes, and a desire for recognition or engagement from the security industry. The public release of PoCs before patches are available creates risk for all organizations using the affected products, potentially enabling malicious actors to weaponize the disclosed techniques.

Historical Context

FalconFlank represents the latest in a series of zero-day disclosures by Chaotic Eclipse targeting endpoint security products. Days before FalconFlank, the researcher released HardBreacher, a privilege escalation exploit for Kaspersky Endpoint Security for Windows (version 14.0.0.504). In August 2026, Chaotic Eclipse published ShieldBreak (CVE-2026-69414), a Microsoft Defender zero-day assessed as a patch bypass for CVE-2026-50656 (RoguePlanet). ShieldBreak built upon techniques from predecessors RedSun (which abused Cloud Files API and TieringEngineService) and LegacyHive (which weaponized offline registry hive manipulation). The researcher's August 14, 2026 statement indicates escalating frustration with Microsoft's lack of communication and restrictions on bug reporting, suggesting a shift toward more aggressive public disclosure timelines aligned with Patch Tuesday windows. Kaspersky has since patched HardBreacher via automatic update, while Microsoft has not yet released a fix for ShieldBreak as of the article date.

Defensive Recommendations

  • Immediately disable the Microsoft Office File Suspicious Macro Removal Windows policy setting in CrowdStrike Falcon as advised by vendor; rely on Cloud Anti-malware for Microsoft Office Files settings instead
  • Review CrowdStrike support portal for the FalconFlank Tech Alert and implement all recommended mitigations and detection guidance
  • Monitor for unusual DLL loading activity and privilege escalation attempts on Windows 11 25H2 and Windows Server 2025 systems, particularly processes interacting with endpoint security agents (T1068, T1574.001)
  • Implement application control policies to restrict unauthorized DLL loads and monitor for suspicious file creation in System32 directory (e.g., phoneinfo.dll, MY_SNAKE_IS_SOLID.dll patterns)
  • Establish enhanced logging for endpoint security product interactions, including remediation actions, policy changes, and process integrity events to detect exploitation attempts targeting security software itself