Precursor Intelligence
Threat News
Latest cyber threat intelligence, breaches and exploitation
4 matching stories
WindowsTrend Micro ZDI: Windows Shell Link zero-day exploited by 11 state-backed groups since 2017
Trend Micro's Zero-Day Initiative disclosed a new Windows Shell Link (.lnk) zero-day (ZDI-CAN-25373) exploited in the wild by 11 state-backed groups since 2017, which Microsoft declined to patch as 'not meeting the bar servicing'.
Nightmare-Eclipse releases ShieldBreak Windows LPE PoC for CVE-2026-62832
The Nightmare-Eclipse actor published ShieldBreak, its tenth Windows LPE PoC, which abuses Cloud Files, Object Manager namespace, Defender API, and a remediation timing race to load a DLL from System32 and execute as SYSTEM.
Sophos MDR Accelerates NetNTLMv1 Rainbow Table Lookups Without GPUs
Sophos MDR research shows that NetNTLMv1 rainbow table lookups can be accelerated without GPU acceleration, reducing the cost and complexity of exploiting the legacy protocol in modern Windows environments.
Nightmare-Eclipse Discloses LegacyHive Windows LPE PoC
The Nightmare-Eclipse persona has released LegacyHive, a local privilege escalation PoC for Windows User Profile Service that abuses offline registry manipulation, following the July 2026 Patch Tuesday.
