Hackers Use Nightmare

Cybersecuritynews •Guru Baran • April 21, 2026

A real-world intrusion campaign leveraging publicly available Nightmare-Eclipse privilege escalation tooling, BlueHammer, RedSun, and UnDefend, following what appears to be unauthorized access through a compromised FortiGate SSL VPN. The incident marks the first confirmed in-the-wild deployment of these tools against a live enterprise environment, raising urgent alarms for security teams globally. The tools at the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Nightmare-Eclipse Tools Exploit FortiGate VPNs in Live Attacks A recent intrusion campaign utilized the Nightmare-Eclipse privilege escalation tools, specifically BlueHammer, RedSun, and UnDefend, following unauthorized access through compromised FortiGate SSL VPN credentials. This incident marks the first confirmed deployment of these tools in a live enterprise environment, impacting organizations globally. Attackers gained access by exploiting compromised VPN sessions traced back to IP addresses in Russia, Singapore, and Switzerland. They executed reconnaissance commands and deployed a custom Go-based tunneling utility named BeigeBurrow to maintain remote access. Malicious binaries were found in user-writable folders, and various commands were executed to enumerate privileges and credentials. Security teams are advised to monitor for specific binary names and suspicious logins, and to apply patches for CVE-2026-33825, which was publicly disclosed on April 14, 2026. Immediate action is recommended to isolate affected endpoints and reset compromised credentials. 2 sources 74

Extracted Entities

Hackers Use Nightmare

The full story

Extracted Entities

Campaigns (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)

Vulnerabilities (3)