This is the same actor that’s been dropping Microsoft 0day here and there, I think.
No official word from Crowdstrike yet, so it’s mostly “wait for Crowdstrike” with a specific nod to one setting, and some detection logic.
The latest of 3 new-ish EDR privescs from Chaotic Nightmare/Nightnare Eclipse
Some updates on this: the FalconFlank attack exploits a known issue with the MareBackup Scheduled Task from Windows. This post is from May 2025.
Basically it’s a two-fer that comprises an insecure ACE on the task, and DLL hijacking potential of old-school PowerShell. This vuln is a general privesc attack, not just limited to CrowdStrike.
This tool, released 3 months ago, verifies vulnerability.
