Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity
Former Microsoft employee Abdelhamid Naceri reveals himself as Nightmare Eclipse, releases new Windows Defender PoC
Abdelhamid Naceri, a former Microsoft Germany employee, has publicly revealed himself as the researcher known as Nightmare Eclipse (also Chaotic Eclipse) who has been releasing Windows and Microsoft Defender proof-of-concept exploits. Naceri released a new PoC exploit called BigDiskBuster that prevents Windows Defender from completing platform and signature updates across all supported Windows versions. He attributed his exploit releases to emotional and financial hardship following his disputed termination from Microsoft and unsuccessful German labor court challenge.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA disgruntled former Microsoft employee publicly released a proof-of-concept exploit (BigDiskBuster) capable of blocking Windows Defender from completing platform and signature updates, effectively disabling a primary endpoint defense mechanism. The root cause extends beyond a technical flaw — it highlights how unresolved employee grievances and insider knowledge can become a direct threat vector when proper offboarding and access controls are not enforced. Organizations relying solely on Windows Defender for endpoint protection are particularly exposed, as blocking signature updates leaves systems vulnerable to the latest malware. This case also underscores the real-world risk of emotionally motivated threat actors who possess deep product knowledge, making their exploits highly targeted and credible.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — BigDiskBuster
- malware — UnDefend