Nightmare Eclipse Releases 'HardBreacher' Exploit for Kaspersky Endpoint Security

New Exploit Targets Kaspersky Product

The security researcher known as Nightmare Eclipse has publicly released a new proof-of-concept (PoC) exploit, named "HardBreacher," which targets a privilege escalation vulnerability in Kaspersky Endpoint Security. This disclosure follows a pattern of the researcher releasing zero-day exploits, often after expressing frustration with vendor vulnerability handling processes.

Vulnerability Details and Impact

The HardBreacher exploit specifically targets a privilege escalation flaw within Kaspersky's endpoint security product. According to Nightmare Eclipse, successful exploitation can lead to the operating system becoming unstable, with the ability to disrupt Kaspersky's UI process and manipulate file access controls. The researcher noted the PoC was not fully refined but demonstrated the vulnerability's potential impact.

Kaspersky's Response

In response to the public disclosure, Kaspersky confirmed that the underlying security issue has been addressed. The company stated that a fix has been delivered to users through an automatic update, and users can also manually trigger a database update to ensure their systems are protected. This rapid response aims to mitigate the risk posed by the publicly available exploit.

Researcher's History of Disclosures

Nightmare Eclipse, also known as Chaotic Eclipse, has a history of disclosing zero-day vulnerabilities and releasing PoC exploits, primarily for Windows and Microsoft Defender flaws. Previous exploits include "ShieldBreak" and "LegacyHive," both of which enabled privilege escalation. The researcher's motivation for public disclosure has been cited as dissatisfaction with how some vendors handle vulnerability reports, leading to a series of public releases of security flaws.