Security News BIg Breaking :- Guardian Turned Gatekeeper: Zero-Day EoP in Kaspersky Endpoint Security Lets Attackers Own the Protector.

[Khushal]

Content source

https://github.com/MSNightmare/HardBreacher

Threat Intelligence Report — HardBreacher PoC​

Repository: MSNightmare/HardBreacher
Classification: Proof-of-Concept — Elevation of Privilege (EoP)
Affected Product: Kaspersky Antivirus for Endpoint v14.0.0.504
Affected Platform: Windows 11 25H2 (fully patched at time of disclosure)
CVE: Unassigned at time of writing
Disclosure Type: Full public PoC, no coordinated disclosure

---

Actor Profile​

HardBreacher was published by the GitHub account MSNightmare, a prolific vulnerability researcher who also operates under the aliases Nightmare Eclipse, Chaotic Eclipse, and INFINITE NIGHTMARE. The actor maintains a blog at deadeclipse666.blogspot.com and, following repeated GitHub and GitLab repository takedowns, has established a self-hosted code distribution platform at projectnightcrawler.dev. Treat that domain and its mirrors as PoC-distribution infrastructure warranting active watchlisting. Picus Security


This actor has an established track record of operationalized releases. Huntress reported that earlier Nightmare Eclipse tooling — BlueHammer, RedSun, and UnDefend — was used in a live attack chain, meaning the actor's releases have a documented history of being picked up by real intrusion operators, not merely collected by researchers. HardBreacher is best understood in this broader context: it represents the third distinct target (Kaspersky Endpoint) after a prior series focused on Windows Defender. Picus Security

---

Vulnerability Summary​

HardBreacher exploits an elevation-of-privilege condition in the Kaspersky Endpoint Security user-interface process. The author's README describes a technique centered on taking control of the Kaspersky UI process — once accomplished, the product loses integrity in a cascading fashion: it stops functioning correctly, can be made to grant or block file access beyond its intended scope, and the underlying operating system enters an unstable state. A successful run drops a file (C:\Windows\System32\MY_SNAKE_IS_SOLID.dll) with full permissions for the current (low-privileged) user — demonstrating arbitrary write into a protected system path.


The repository ships two components: the HardBreacher directory (the EoP exploit itself) and SolidSnake (a companion payload or shellcode stager, name referencing the artifact it drops). The PoC is described by the author as deliberately rough — it is not deterministic and requires repeated execution before succeeding — but the author explicitly states confidence that the primitive can be refined into a stable, silent, one-click exploit given sufficient time and resources.

---

Technical Assessment​

The attack surface is notable for the same reason as the actor's Defender-focused work: endpoint security software operates with elevated privileges by design, and any exploitable code path within that trusted boundary converts a defensive tool into a stepping stone for privilege escalation. Kaspersky Endpoint Security runs with kernel-adjacent permissions to perform real-time file inspection and process monitoring, making its UI process an attractive pivot point. Compromising the UI process at sufficient depth appears to allow the exploit to manipulate the product's internal access-control decisions — granting write access to System32 for an arbitrary user, a path normally protected by both NTFS DACLs and virtualization.


The EoP vector does not require network access, social engineering, or any prior administrative foothold. A standard user account on an affected endpoint with Kaspersky Endpoint Security v14.0.0.504 installed is sufficient.

---

Broader Nightmare Eclipse Context​

HardBreacher is part of a larger pattern of security-tool targeting by this actor. The researcher, going by Chaotic Eclipse (aka INFINITE NIGHTMARE, MSNightmare, and Nightmare-Eclipse), has separately released a PoC called ShieldBreak demonstrating a patch bypass for CVE-2026-50656 (RoguePlanet), a race-condition EoP in Microsoft Defender. Independent validation by Kevin Beaumont and Will Dormann confirms the ShieldBreak PoC functions as long as Microsoft Defender is enabled. Taken together, this actor appears to be systematically targeting the endpoint protection layer across multiple vendors — a deliberate research or adversarial focus on subverting the tools organizations rely on most. The Hacker NewsCryptron


The MIT-licensed source code means the technique can be forked, modified, and integrated into attacker toolchains before any vendor response, with no coordination or advanced skills required. This licensing posture is consistent across the actor's other releases. AI Weekly

---

Detection & Mitigation Guidance​

Immediate. Organizations running Kaspersky Endpoint Security v14.0.0.504 on Windows 11 should monitor for anomalous file creation events in C:\Windows\System32\ by non-SYSTEM, non-administrative processes. Any DLL drop in that path by a standard user should be treated as a high-confidence indicator of compromise.


Process integrity. Implement additional monitoring on the Kaspersky UI process (avp.exe or equivalent) for unexpected child-process spawning, handle inheritance abuse, or UI Automation API calls originating from low-integrity contexts.


Patch posture. Contact Kaspersky for a vendor advisory; no CVE has been assigned and no patch was available at the time the PoC was published. Track Kaspersky's security bulletin channel for an update targeting v14.0.0.504.


Infrastructure watchlist. Add projectnightcrawler.dev, deadeclipse666.blogspot.com, and the GitHub handle MSNightmare and known mirrors to your threat-intelligence watchlist for early warning of follow-on PoC releases targeting additional endpoint vendors.


Hunting pivot. The repository name SolidSnake and the artifact filename MY_SNAKE_IS_SOLID.dll can serve as string-based hunting pivots in EDR telemetry and retrospective log review.

GitHub - MSNightmare/HardBreacher: Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability

Kaspersky Antivirus For Endpoint ZeroDay Elevation of Privileges Vulnerability - MSNightmare/HardBreacher

github.com

 

[Bot]

Assessment

The report contains several claims that cannot be confirmed from the text alone and should not be treated as an established threat-intelligence finding without independent validation.

The repository, affected Kaspersky build, Windows version, exploit reliability, and alleged vulnerability details should be verified against:

• Kaspersky’s official security advisories and support channels
• Microsoft security documentation for the stated Windows release
• Independent technical analysis from reputable researchers
• Reproducible testing in an isolated, non-production virtual machine

A public GitHub repository and third-party articles are not sufficient by themselves to establish that an exploit works on fully patched systems or that it provides reliable elevation of privilege.

Claims requiring caution

• The report presents attribution and infrastructure-watchlist statements as fact, but the supplied material does not establish that the various aliases, domains, and repositories are controlled by the same person.
• A dropped file named C:\Windows\System32\MY_SNAKE_IS_SOLID.dll would be a useful hunting indicator only if the PoC’s behavior is independently confirmed. It is not automatically evidence of compromise, since researchers or testers could create the same file.
• The statement that a standard user can reliably write to System32 needs proof through a reproducible test and precise documentation of the affected process, permissions, and security boundaries.
• The references to “kernel-adjacent permissions,” NTFS virtualization, UI Automation, and handle inheritance are technically broad and do not identify the actual vulnerable mechanism.
• Claims that earlier tools were used in live attacks should be supported by primary incident-response reporting, including hashes, timelines, and observed intrusion telemetry.
• A MIT license does not by itself establish that a technique requires no advanced skills, will be integrated by attackers, or will become operationally reliable.

Safer validation procedure

Do not execute the repository on a production endpoint. If analysis is necessary:

1. Obtain the repository from its official source and record the commit ID, release archive hash, and included binaries.
2. Analyze the source and binaries statically before execution.
3. Use an isolated virtual machine with no access to production credentials or sensitive data.
4. Capture process creation, image loads, file writes, registry changes, service activity, security-product events, and security-token changes.
5. Repeat testing on the exact Kaspersky and Windows builds claimed in the report.
6. Submit suspicious binaries to VirusTotal or the relevant vendor, while considering the confidentiality implications of uploading samples.
7. Report a confirmed vulnerability to Kaspersky through its official vulnerability-reporting channel.

For defensive monitoring, alert on unexpected non-administrative writes to protected system directories, unusual behavior involving Kaspersky processes, and unsigned or newly created DLLs. These should be investigated with process ancestry, signer information, hashes, user context, and timestamps rather than treated as conclusive indicators by filename alone.

Conclusion

This should currently be described as an unverified public PoC claim, not as a confirmed exploitable vulnerability or active threat campaign. Until Kaspersky or credible independent researchers reproduce the behavior, organizations should avoid executing the PoC, maintain current endpoint-security updates, and monitor official vendor advisories.