Threat Actors eclipse

eclipse

TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: Chaotic Eclipse, Nightmare-Eclipse, now MSNightmare, labels, CVE-2026-33825

Goals & Targeting

Objectives

Ransomware

Financial Gain

Targeted Sectors

Government

Defense

Healthcare

Hospitality

Financial services

Media

Critical infrastructure

Education

Targeted Countries / Regions

AI Analysis

No AI analysis yet.

ATT&CK Techniques

Collection

2 techniques

T1005

Data from Local System

T1074

Data Staged

Command & Control

3 techniques

T1071

Application Layer Protocol

T1090

Proxy

T1105

Ingress Tool Transfer

Credential Access

1 technique

T1003

OS Credential Dumping

Execution

3 techniques

T1053

Scheduled Task/Job

T1059

Command and Scripting Interpreter

T1559

Inter-Process Communication

Initial Access

1 technique

T1190

Exploit Public-Facing Application

Lateral Movement

1 technique

T1021

Remote Services

Persistence

1 technique

T1176.002

IDE Extensions

Resource Development

2 techniques

T1584

Compromise Infrastructure

T1588

Obtain Capabilities

Stealth

1 technique

T1078

Valid Accounts

Software / Tooling

Atmosphere

Backdoors

BlackSuit

Crisis

Curl

Dark

DragonForce

DragonForce ransomware

EDR-Freeze

Epic

Expand

GO Simple Tunnel

GOST

Gentlemen

Glasses

Global

Jupiter

Kuiper

Leverage

Living off the Land

Luna

Malicious files

Malware

Mars

Play

Python script

Rogue

Royal

STOP

Scout

SentinelOne

Solar

UPSTYLE

Unknown

Visual Studio Code

Zero-day exploits

inter

phishing

rock

whoami

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

View all →

SHA-256 Hash 1 URL 2 IPv4 Address 11 Filename 5 Domain 1

SHA-256 Hash 1

3de2a4392b8715bad070b2ae12243f166ead37830f7c6d24e778985927f9caac

50% TLP:CLEAR

URL 2

http:///patch|bash

50% TLP:CLEAR

http:///policy

50% TLP:CLEAR

IPv4 Address 11

179.43.140.214

212.232.23.69

78.29.48.29

38.180.41.251

45.121.51.2

203.160.86.91

154.223.16.34

38.60.218.153

38.180.128.159

64.176.226.203

38.180.106.167

Filename 5

M365Copilot.exe

update.py

z.exe

RedSun.exe

FunnyApp.exe

Domain 1

DfndrPEBluHmr.BZ

50% TLP:CLEAR

Open in full Indicators list →

References

www.huntress.com — Cited by web research for: CVE-2026-33825
attack.mitre.org — Cited by web research for: T1071
science.nasa.gov — Cited by web research for: Mars
unit42.paloaltonetworks.com — Cited by web research for: Python script
science.nasa.gov — Cited by web research for: Epic

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

Type: Criminal
Sophistication: Medium
Primary Motivation: Organizational gain
Confidence: 80%
Added: Aug 12, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.