[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWFTE7xQdjPDadzUkdsFh1u1Pi1HaKq03N9djoEe8HBE":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"3d077518-5bd0-49c6-8f1d-c046dcd3038c","Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity","nightmare-eclipse-drops-new-microsoft-defender-exploit-after-revealing-identity-53610b","Abdelhamid Naceri, a former Microsoft Germany employee, is the exploit leaker Nightmare Eclipse, aka Chaotic Eclipse. The post Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity appeared first on SecurityWeek.","Abdelhamid Naceri, a former Microsoft Germany employee, has publicly revealed himself as the researcher known as Nightmare Eclipse (also Chaotic Eclipse) who has been releasing Windows and Microsoft Defender proof-of-concept exploits. Naceri released a new PoC exploit called BigDiskBuster that prevents Windows Defender from completing platform and signature updates across all supported Windows versions. He attributed his exploit releases to emotional and financial hardship following his disputed termination from Microsoft and unsuccessful German labor court challenge.","Former Microsoft employee Abdelhamid Naceri reveals himself as Nightmare Eclipse, releases new Windows Defender PoC","https:\u002F\u002Fwww.securityweek.com\u002Fnightmare-eclipse-drops-new-microsoft-defender-exploit-after-revealing-identity\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002Fhacker-unmasked.jpeg","2026-09-22T13:26:51+00:00","2026-09-22T14:00:41.548899+00:00",7,[17,20,23,26],{"name":18,"type":19},"Abdelhamid Naceri \u002F Nightmare Eclipse \u002F Chaotic Eclipse","threat_actor",{"name":21,"type":22},"Microsoft","vendor",{"name":24,"type":25},"Windows Defender","product",{"name":27,"type":25},"Windows","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"malware","BigDiskBuster","PoC exploit preventing Windows Defender platform and signature updates",{"type":51,"value":55,"context":56},"UnDefend","Related Defender exploit PoC mentioned as similar to BigDiskBuster",[21,24,27],{"controls":59,"vendors":146},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":90,"name":91,"problem":92,"products":93},"patch-management","Automated patch management","Known holes get closed in days, not months.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":119,"name":120,"problem":121,"products":122},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[123,131,138],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":132,"vendor_name":21,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",[147],{"slug":132,"name":21,"logo_path":133,"roles":148},[149],"affected",{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":167},"insider-grievance-fuels-public-microsoft-defender-exploit-release","Insider Grievance Fuels Public Microsoft Defender Exploit Release","A disgruntled former Microsoft employee publicly released a proof-of-concept exploit (BigDiskBuster) capable of blocking Windows Defender from completing platform and signature updates, effectively disabling a primary endpoint defense mechanism. The root cause extends beyond a technical flaw — it highlights how unresolved employee grievances and insider knowledge can become a direct threat vector when proper offboarding and access controls are not enforced. Organizations relying solely on Windows Defender for endpoint protection are particularly exposed, as blocking signature updates leaves systems vulnerable to the latest malware. This case also underscores the real-world risk of emotionally motivated threat actors who possess deep product knowledge, making their exploits highly targeted and credible.",[155,156,157,158,159,160,161,162,163,164,165,166],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 10: Malware Defenses","CIS Control 5: Account Management (offboarding)","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 IR-6: Incident Reporting","NIST SP 800-53 PS-4: Personnel Termination","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-61 Rev. 2: Computer Security Incident Handling Guide","ISO\u002FIEC 27001 A.7.3: Termination and Change of Employment","ISO\u002FIEC 27001 A.12.2: Protection from Malware","ITIL: Change and Release Management (emergency patch procedures)",{}]