Nightmare-Eclipse Tooling Seen in Real-World Intrusion

Reported 20 Apr 2026 by otx · Severity: medium

Activity involving BlueHammer, RedSun, and UnDefend tooling from the Nightmare-Eclipse proof-of-concept repository was observed during a live intrusion investigation. The malicious binaries were staged in user-writable directories including Pictures and Downloads folders, with ex