RoguePlanet

ACTIVE CAMPAIGN TRACKED ▲ High Threat

Primary Aliases: Chaotic Eclipse Dead Eclipse INFINITE NIGHTMARE MSNightmare

Sponsor / State Affiliation Independent / Not Attributed

Primary Motivation personal grievance and retaliation against Microsoft

Active Timeline Unknown – Present

Confidence Rating 95% (Grounded)

Retaliatory Windows Zero-Day Campaign, RoguePlanet Zero-Day Disclosure, LegacyHive/GreatXML Disclosures

⚔️ Weaponized CVE Matrix (1)

Weaponized Vulnerability

CVSS 8.5 KEV EPSS 85.0%

🎯 Target Sectors & Focus

Microsoft Windows ecosystem Microsoft Defender BitLocker Windows Recovery Environment (WinRE) Windows User Profile Service

🛡️ MITRE ATT&CK® Attack Lifecycle (6 TTPs)

📥 Download Navigator JSON

Persistence & Privilege Escalation 2

T1547 Manipulation of Windows User Profile service for cross-user registry hive loading

T1547 Local Privilege Escalation (LPE) to NT AUTHORITY\SYSTEM

Command & Control 1

T1071 Exploitation of Windows Recovery Environment (WinRE) configuration files (unattend.xml)

Operational Techniques 3

T1000 Uncoordinated full disclosure of proof-of-concept (PoC) exploits

T1000 Time-of-Check to Time-of-Use (TOCTOU) race conditions

T1000 Abuse of NTFS directory junctions and opportunistic locks

📰 Verified Campaigns & Intelligence Archive

🔔 Subscribe to Alerts

[DEEP DIVE] Microsoft Defender: Critical Patch Bypass for CVE-2026-50656 RoguePlanet

Attacks and Vulnerabilities 2026-08-14

[DEEP DIVE] Microsoft Defender: RoguePlanet Zero-Day CVE-2026-50656 and Woodgnat Exploitation

Attacks and Vulnerabilities 2026-07-01

Copied to clipboard

LINK COPIED TO CLIPBOARD