Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit

Summary

The researcher known as Nightmare Eclipse has released a privilege escalation exploit, dubbed 'HardBreacher,' targeting a vulnerability in Kaspersky Endpoint Security. While the exploit is described as a proof-of-concept, it can cause significant system instability if successful. Kaspersky has confirmed the vulnerability and stated that a fix has been delivered via an automatic update.

Full text

The researcher known as Nightmare Eclipse has dropped another zero-day — this time a privilege escalation exploit targeting a Kaspersky endpoint security product. Nightmare Eclipse, also known as Chaotic Eclipse, has released PoC exploits for many vulnerabilities in recent months, mainly Windows and Microsoft Defender flaws. The researcher started dropping zero-days after growing frustrated with Microsoft’s handling of vulnerability reports. While many of the exploits remained at the PoC stage, a few ended up being exploited in the wild by malicious actors. Over the weekend, Nightmare Eclipse released an exploit targeting a privilege escalation vulnerability in Kaspersky Endpoint Security. The exploit has been dubbed HardBreacher. “The PoC is not in the best shape at all, it is basically duct tapped, I just managed to make it work and that’s all,” the researcher noted. “The interesting part about this is the Kaspersky completely loses it when you take control over the UI process, you can cause it to stop functioning, grant/block access to files its not supposed to, if the PoC succeeds, the entire operating system becomes a hot mess,” the researcher added.Advertisement. Scroll to continue reading. Contacted by SecurityWeek, Kaspersky said the underlying issue has been resolved. “The corresponding fix is delivered via an automatic update, or users can trigger a database update manually,” Kaspersky stated. Other exploits made public recently by Nightmare Eclipse include ShieldBreak, which allows an attacker to spawn a shell with System privileges, and LegacyHive, which enables privilege escalation. Related: Log4j Remote Code Execution Scare Related: Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs Related: More Details Emerge on Exploited PaperCut Vulnerabilities Written By Eduard Kovacs Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Eduard Kovacs More Details Emerge on Exploited PaperCut VulnerabilitiesHasbro Data Breach Exposed Employee Personal InformationATF Confirms Cyber Incident After Ransomware Group Claims AttackOpenAI Agents Exploited Linux Kernel Flaw on Company’s Own SystemsTech, Cybersecurity Giants Unite Behind OpenAI-Led Cyber Defense PledgePaperCut Releases Emergency Patch for Exploited Zero-DayTrump Order Aims to Block Foreign Backdoors in US Power Grid GearAustralia Arrests 2 Alleged TeamPCP Hackers Latest News ServiceNow Patches 3 Critical Code Injection VulnerabilitiesMcKesson Confirms Data Breach as Attacker Deadline LoomsWhat the Hugging Face Incident Teaches Security Leaders About AI Agent AccessAnthropic Warns Claude Users of Infostealer Malware InfectionsCritical Ruby on Rails Vulnerability in Attackers’ CrosshairsBoston Scientific Still Recovering From CyberattackExtortion Group Claims Manchester Airports Group Data BreachJudge Says Pentagon’s Measures Against Anthropic Were ‘Illegal and Baseless’ Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveSocial engineering protection company Doppel has promoted Alyssa Smrekar to Chief Marketing Officer.Naveen Bhateja has been appointed Chief People Officer at HackerOne.The Department of War has appointed Sonu Shankar as Principal Deputy Chief Information Officer.More People On The MoveExpert Insights What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Hired for One Job, Judged on Another: The CISO’s Real Problem The skills that get a CISO hired are rarely the skills they are judged on later. Most security leaders are stuck in that gap. Closing it is the real job. (Sravish Sridhar) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — HardBreacher

Entities