LegacyHive Exploit Abuses Windows Profile Loading to Hijack User Registry Hives

LegacyHive is a newly discovered proof-of-concept (PoC) for Windows that exploits profile initialization and offline registry hive manipulation to redirect user-level registry paths, potentially allowing access to resources associated with another account.

This technique was published by the Nightmare-Eclipse disclosure actor shortly after Microsoft’s July 2026 Patch Tuesday. Unlike traditional software vulnerabilities, LegacyHive chains legitimate Windows features in an unusual manner.

LegacyHive Exploit

Researchers from LevelBlue SpiderLabs successfully reproduced the PoC on fully updated Windows systems, demonstrating that the exploit remains viable even after current updates.

The attack requires a low-privilege attacker account and credentials for a separate helper account, making this public implementation primarily a post-compromise capability.

LegacyHive modifies the helper account’s ntuser.dat registry hive while it is offline and then manipulates Windows to load the altered profile. This results in Windows consuming attacker-controlled values during typical profile initialization.

Specifically, the PoC redirects the Local AppData value under Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders, replacing the expected file system location with a path controlled through the Windows NT Object Manager namespace.

The exploit starts by creating a custom namespace beneath \BaseNamedObjects\Restricted\<UUID>. It utilizes native APIs such as NtCreateDirectoryObjectEx to create Object Manager directories and NtCreateSymbolicLinkObject to build symbolic links within that namespace.

Unlike standard Windows shortcuts, symbolic links, or NTFS junctions, these objects exist at a lower level within the NT Object Manager. Legitimate user applications rarely create such structures, particularly in conjunction, making this activity a valuable signal for endpoint detection.

Subsequently, the exploit employs Microsoft’s Registry Offline API, accessible through offreg.dll, to open and edit the helper account’s ntuser.dat file directly.

By modifying the hive while it is not actively loaded, the attacker avoids altering the live user registry. Once saved and restored, the malicious configuration persists in the user hive.

Researchers noted that Local AppData values pointing to \BaseNamedObjects, NT-style paths, or other kernel namespaces are highly abnormal and should be treated as suspicious during forensic reviews.

To ensure reliable execution, LegacyHive places a batch opportunistic lock, or oplock, on UsrClass.dat. This allows the PoC to wait until Windows reaches a specific stage of profile initialization instead of relying on unreliable timing.

The attacker then uses CreateProcessWithLogonW with the LOGON_WITH_PROFILE flag to launch a process under the helper account. In this public PoC, the process used is notepad.exe; however, researchers emphasized that defenders should not base their detection on this specific binary.

The focus should be on the behavior of cross-account process launching, which necessitates a complete profile load, often involving the Secondary Logon service.

When the helper account profile loads, Windows reads the manipulated hive and resolves the altered Local AppData setting through the attacker-created Object Manager links.

LegacyHive validates this result using RegOpenUserClassesRoot, confirming that Windows exposes the redirected user hive state. Although the PoC deletes temporary files, it leaves modified registry settings and Object Manager redirection artifacts intact, creating a lasting impact after cleanup.

Defenders should look for correlated behaviors rather than a single indicator. High-confidence signals include:

• Calls to NtCreateDirectoryObjectEx and NtCreateSymbolicLinkObject from the same non-system process.
• Offline access, copying, or modification of ntuser.dat and UsrClass.dat outside standard user-profile locations.
• Registry values for Local AppData that resolve to \BaseNamedObjects rather than a normal profile directory.
• Batch oplock requests involving registry hive files.
• CreateProcessWithLogonW activity using LOGON_WITH_PROFILE, especially across accounts.

LegacyHive illustrates how Windows profile loading can become a potential attack surface even without a traditional unpatched flaw.

Organizations should prioritize behavioral telemetry encompassing native API calls, registry-hive staging, profile-load events, and unusual cross-account process creations. At the same time, vendors explore mitigations for this type of exploitation.

ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.