Affected Systems

CrowdStrike Falcon Sensor (all current versions) on Windows 11 25H2 and Windows Server 2025. Vulnerability exploits the Office malicious macros remediation feature. No CVE assigned yet.

Exploitation Status

Public PoC released by researcher "Nightmare Eclipse". Exploit confirmed working by independent security experts. CrowdStrike states detections are now in place, but obfuscation may bypass signatures.

Business Impact

Attackers with local access can escalate to SYSTEM privileges, bypassing CrowdStrike's own endpoint protection. This undermines the security posture of organizations relying on Falcon for privilege escalation defense. CrowdStrike advises disabling the vulnerable feature (File Suspicious Macro Removal) as a workaround, which may reduce protection against macro-based threats. Organizations face a trade-off between mitigating this zero-day and maintaining full macro protection coverage.

Urgency

đź”´ Immediate

Recommended Actions

  • Disable the 'Microsoft Office File Suspicious Macro Removal' Windows policy setting in CrowdStrike Falcon immediately via group policy or Falcon console
  • Review CrowdStrike support portal for the FalconFlank Tech Alert (requires customer account access) for additional guidance and detection rules
  • Monitor Windows event logs and CrowdStrike Falcon logs for suspicious SYSTEM-level process creation, especially command prompts spawned by unexpected parent processes
  • Audit local administrator access and enforce least privilege to limit initial access vectors for exploitation
  • Apply CrowdStrike sensor updates as soon as a patch is released; subscribe to CrowdStrike security advisories for notification

---

# Threat Actor Context

Actor Profile

Nightmare Eclipse is an anonymous security researcher known for disclosing multiple zero-day vulnerabilities across major security and operating system vendors. Since April 2026, the actor has released privilege escalation and denial-of-service exploits targeting Microsoft products (Defender, BitLocker, Windows components), CrowdStrike Falcon, Kaspersky Antivirus, Avast Antivirus, and Nvidia drivers. The motivation appears to be public disclosure of unpatched vulnerabilities, potentially to pressure vendors into faster remediation. The actor operates under a single pseudonymous handle and has demonstrated consistent capability to identify privilege escalation flaws in endpoint security products.

TTPs (Tactics, Techniques, Procedures)

Primary TTP observed is T1068 (Exploitation for Privilege Escalation). The FalconFlank exploit abuses CrowdStrike Falcon's Office malicious macros remediation feature to spawn a SYSTEM-level command prompt on fully updated Windows 11 25H2 and Windows Server 2025 systems. The actor has noted that obfuscation and alternative DLL loading techniques can bypass detection. Additional disclosed exploits (HardBreacher, PrettyPrague, GreenSection) indicate capability across T1068 and T1499 (Endpoint Denial of Service). The actor's disclosure methodology involves public release of proof-of-concept code with technical details, suggesting T1587.001 (Develop Capabilities: Malware) for exploit development.

Targets & Patterns

Nightmare Eclipse does not appear to target specific organizations or sectors directly. Instead, the actor targets widely deployed security and operating system software, creating risk for any organization using affected products. The FalconFlank zero-day specifically impacts enterprises relying on CrowdStrike Falcon endpoint protection on Windows 11 and Windows Server 2025. The pattern of disclosures—targeting Microsoft, CrowdStrike, Kaspersky, Avast, and Nvidia—suggests the actor focuses on high-impact vendors with large customer bases. The public release of working exploits creates immediate risk for all customers of these vendors, particularly those unable to rapidly apply workarounds or patches.

Historical Context

Nightmare Eclipse has been actively disclosing zero-days since April 2026. Previous Microsoft-focused exploits include LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend—targeting Defender, BitLocker, and Windows components. Microsoft has patched LegacyHive, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma, but BlueHammer, RedSun, and UnDefend remain unpatched. Microsoft responded to early disclosures with warnings of legal action against "malicious activity causing real harm," which many interpreted as a direct threat to the researcher. In September 2026, Nightmare Eclipse expanded targeting to include endpoint security vendors (CrowdStrike, Kaspersky, Avast) and hardware vendors (Nvidia). Cybersecurity expert Kevin Beaumont confirmed the legitimacy of the September 2026 exploits.

Defensive Recommendations

  • Immediately disable the Microsoft Office File Suspicious Macro Removal Windows policy setting in CrowdStrike Falcon as advised by vendor; rely on Cloud Anti-malware for Microsoft Office Files settings instead
  • Monitor for unusual SYSTEM-level command prompt spawning (cmd.exe, powershell.exe) originating from CrowdStrike Falcon processes using EDR telemetry and Sysmon Event ID 1
  • Add FalconFlank proof-of-concept indicators to detection rules; monitor for suspicious DLL loading techniques (T1055) associated with CrowdStrike Falcon service processes
  • Review and restrict local administrator privileges to limit post-exploitation impact of privilege escalation exploits (T1068)
  • Consult CrowdStrike's FalconFlank Tech Alert in the support portal for vendor-specific indicators and apply patches immediately when available; track CVE assignment for this vulnerability