Researcher Nightmare Eclipse Releases New Microsoft Defender Exploit

The researcher known as Nightmare Eclipse has released a new proof-of-concept exploit named BigDiskBuster, which targets the update mechanisms of Microsoft Defender.

The tool is designed to prevent Windows Defender from successfully completing its platform and signature updates. Described as being similar to the ‘UnDefend’ tool, the researcher stated that the exploit is intended to work across all currently supported versions of Windows, although he cautioned that the current code is buggy and requires further refinement.

In a recent development, the individual behind the pseudonyms Nightmare Eclipse, Chaotic Eclipse, and MSNightmare, has revealed his identity as Abdelhamid Naceri.

Identity and Background

Naceri is a former Microsoft employee who previously worked for the company in both the United Kingdom and Germany. He has shared accounts of his departure from the firm, alleging that his employment was terminated abruptly without clear justification.

Naceri claimed that he challenged his dismissal in a German labour court, but stated that the court ultimately upheld the termination. He also clarified that previous claims suggesting Microsoft had initiated legal action against him were fabricated.

The release of BigDiskBuster follows a rapid series of proof-of-concept exploits published by Naceri over recent months. His previous disclosures have included zero-day vulnerabilities and exploits affecting products from CrowdStrike, Nvidia, Avast, and Kaspersky.