The Nightmare-Eclipse disclosure actor has released LegacyHive, its latest Windows proof-of-concept, following prior drops including GreenPlasma, YellowKey, MiniPlasma, RoguePlanet, and GreatXML.
Unlike traditional vulnerability disclosures, LegacyHive doesn’t exploit a memory corruption bug or logic flaw; instead, it abuses legitimate Windows profile initialization and registry hive loading mechanisms to hijack another user’s environment.
LevelBlue’s OpsIntel CTI and THOR teams reproduced the exploit chain on fully patched Windows systems running July 2026 Patch Tuesday updates, confirming it works exactly as described.
LegacyHive Abuses Windows Profile Loading
LegacyHive requires a low-privilege attacker account plus credentials for a separate helper account, and the exploit unfolds across seven stages.
It begins by creating a hidden NT Object Manager namespace under \BaseNamedObjects\Restricted using NtCreateDirectoryObjectEx, then builds symbolic links via NtCreateSymbolicLinkObject to redirect path resolution.
Next, it modifies the helper account’s ntuser.dat offline using Microsoft’s Registry Offline API (offreg.dll), replacing the Local AppData value under User Shell Folders with a path pointing into the attacker-controlled namespace.
A batch oplock is then set on UsrClass.dat so the exploit can precisely control when Windows consumes the tampered hive, after which CreateProcessWithLogonW is called with the LOGON_WITH_PROFILE flag to force a full profile load.
Success is confirmed via RegOpenUserClassesRoot, and finally temporary files are cleaned up while the persistent registry redirection is left intact.
When the helper account signs in, Windows resolves Local AppData into the attacker-controlled Object Manager namespace instead of the real profile path, exposing resources tied to the target account.
Every individual API call here is legitimate in isolation, which is what makes this technique difficult to catch with signature-based tools alone. Because no single API call is inherently malicious, defenders need behavioral correlation rather than static signatures to catch this activity.
The strongest indicator is a user-mode process combining NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject calls, since legitimate software almost never uses both together outside of system components.
Equally telling is a Volatile Environment registry key where %LOCALAPPDATA% resolves into \BaseNamedObjects instead of a standard filesystem path, alongside off-path staging or copying of ntuser.dat or UsrClass.dat outside normal profile directories.
Cross-account CreateProcessWithLogonW calls using LOGON_WITH_PROFILE via seclogon, as well as non-system processes loading offreg.dll, round out the behavioral fingerprint.
LevelBlue published a YARA rule targeting the binary itself, along with three SentinelOne hunting queries covering Volatile Environment path injection, suspicious hive file paths, and cross-account seclogon activity.
The public PoC requires helper account credentials, positioning it as a post-compromise capability rather than a standalone attack, likely an intentional limitation to slow abuse.
LevelBlue noted the target executable (notepad.exe in demos) is easily swapped, so detection should focus on the pattern of offline hive tampering, Object Manager manipulation, and controlled profile loading rather than specific binaries.
Microsoft has not yet issued mitigations for this class of abuse, making behavioral detection the primary defense for now.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
