InfoSecBulletin Cybersecurity for mankind
An unnamed security expert known as “Nightmare Eclipse” shared a CrowdStrike Falcon zero-day exploit called “FalconFlank.” This tool allows hackers to gain higher access on current Windows systems.
Nightmare Eclipse reports that the new weakness, still without a CVE ID, impacts devices using the latest Windows 11 and Windows Server versions, along with CrowdStrike’s security platform.
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Successful exploitation allows attackers to spawn a command prompt with SYSTEM privileges by abusing CrowdStrike Falcon’s Office malicious macros remediation feature.
“FalconFlank is a 0day privilege escalation that abuses the office malicious macros remediation in Crowdstrike Falcon Sensor, obviously by the time I drop this Crowdstrike would already have detections for it so if you want to test you either have to add it to the exclusions or obfuscate the PoC and change the dll load technique,”
Nightmare Eclipse said . “As of now it works in a fully updated windows 11 25H2 / Windows Server 2025 with Crowdstrike Falcon.”
Crowdstrike spokesperson said, “We are actively investigating these claims and advise customers to disable the Microsoft Office File Suspicious Macro Removal Windows policy setting.” “Customers remain protected through the Cloud Anti-malware for Microsoft Office Files settings. We refer customers to the FalconFlank Tech Alert in the CrowdStrike support portal.”
Although the company also shared this link to the tech alert regarding the FalconFlank zero-day exploit, the advisory is not public, and customers can access it only if they have an account on CrowdStrike’s support portal.
Kaspersky, Avast, Nvidia, and Microsoft zero-days
This week, Nightmare Eclipse also shared zero-day exploits that let users gain extra control over Kaspersky Antivirus for Endpoint (called HardBreacher) and GenDigital Avast Antivirus (called PrettyPrague). They also released a zero-day for Nvidia (called GreenSection) that will crash the system.
Cybersecurity expert Kevin Beaumont confirmed on Thursday that the privilege escalation exploits released by Nightmare Eclipse this week are real and work.
Nightmare Eclipse has also disclosed multiple zero-day exploits targeting multiple Microsoft products since April, including Microsoft Defender, BitLocker, and various other Windows components.
These Microsoft zero-days are known as LegacyHive, RoguePlanet, BlueHammer, RedSun, YellowKey, GreenPlasma, MiniPlasma, and UnDefend. While the LegacyHive, RoguePlanet, YellowKey, GreenPlasma, and MiniPlasma flaws have since been fixed, the other security flaws remain zero-days and are still awaiting an official patch.
After Nightmare Eclipse disclosed the first zero-days, Microsoft responded with warnings of legal action against people engaging in “malicious activity causing real harm to our customers,” prompting many to believe that the company was directly threatening the security researcher.
Related Topic:
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
CrowdStrike publish Root Cause of Global System Outages
