RoguePlanet: Windows Zero-Day Weaponizes Defender Quarantine Pipeline

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

RoguePlanet: Windows Zero-Day Weaponizes Defender Quarantine Pipeline

Key Findings

  • Local privilege escalation from a standard unprivileged user to NT AUTHORITY\SYSTEM, confirmed by Howler Cell on Windows 11 Pro. No kernel bug, no memory corruption, no admin rights required.
  • PoC published on GitHub on June 10, 2026 under the MSNightmare handle, with mirrors on a self-hosted Git server. No coordinated disclosure, no CVE, no patch.
  • The chain abuses Defender’s real-time scan and quarantine pipeline, NTFS directory junctions, opportunistic locks, Volume Shadow Copy, and the WER QueueReporting scheduled task. Each component is a legitimate Windows feature. The vulnerability exists only in the sequence.
  • RoguePlanet forces Defender to create a SYSTEM-owned quarantine artifact inside attacker-controlled space, overwrites it with the payload, then triggers WER QueueReporting (running as SYSTEM) to execute it. A three-stage junction swap makes the payload resolve at a path structurally identical to C:\Windows\System32\wermgr.exe.
  • The binary is self-referential. One IsRunningAsLocalSystem check at entry switches between unprivileged orchestrator and SYSTEM payload. An embedded ISO supplies the EICAR source without ever dropping it as a standalone file, which also blocks the chain on Windows Server, where standard users cannot mount ISOs.
  • A Poseidon I/O subsystem (generator plus one worker thread per logical core) makes the oplock race windows deterministic in lab conditions. Production system variability, including differing scheduler behavior, background load, and hardware configurations, reintroduces timing uncertainty in the field. The researcher reports 100% success on some test machines and failure on others.
  • Defender signature Exploit:Win32/DfndrRugPlnt.BB flags the compiled sample only. Minor source changes defeat it. The behavioral chain remains undetected by static means.

Summary

Hours after Microsoft shipped the June 2026 Patch Tuesday fixes, the researcher known as Nightmare-Eclipse resurfaced on GitHub under a new alias: MSNightmare. The repository contained RoguePlanet, a seventh Windows local privilege escalation exploit targeting Microsoft Defender. The pattern is a systematic campaign against a single attack surface, executed at a pace and technical depth that signals sustained, deliberate investment in mapping Defender's internal architecture.

Article Link: RoguePlanet: Windows Zero-Day Weaponizes Defender Quarantine Pipeline