Hey guys, strap on.
Today we're looking at a drama that could come straight from a cyberpunk thriller. It's about hurt pride, nasty Windows internals, the arrogance of a tech giant, and a series of zero-day exploits that cause Microsoft's security architecture to collapse like a house of cards.
We are talking about the feud between Microsoft under the pseudonym Nightmare Eclipse (also known as Chaotic Eclipse or Dead Eclipse) Acting Security researcher.
Since April 2026, this actor has not left Redmond a quiet minute. He almost ritually drops to the rhythm of the Patch Tuesdays One critical zero-day after another. Only this week (for Mega Patchday on July 14th In 2026, there were ‘LegacyHive’ The next prank.
But it's not just a technical spectacle. It's a lesson about how a global corporation The Proverbial Messenger, Instead of doing your own homework. But let's start over.
The Explosive History: When the insider becomes an enemy of the state
Behind the handle Nightmare eclipse stuck Not a bored script kiddie.. loud Research by safety veteran Brian Krebs This is a Former Microsoft security worker, which probably According to an article by medium.com was employed in Redmond from September 2022 to June 2025.
This is where the tragedy begins. This developer reports that Microsoft persistently ignored its internally filed reports, denied communication, and even ended up deleting the account through which it submitted the vulnerabilities. He went out empty ‘zero, nada, nothing’ for hard work and in-depth security research. You can understand the frustration.
If you humiliate a high-profile kernel specialist so deeply, you shouldn't be surprised when the boomerang flies back. The researcher vowed revenge in the form of absolutely precise, hitherto unpatched exploits. The exploit codes include comments such as:
"IHATEMICROSOFT SERIOUSLYMSFT"Let's see how long you can play this game.
The technical demolition light: Latest exploits in detail
What Nightmare-Eclipse delivers is not a theoretical banter, but highly functional code for local rights extension (Local Privilege Escalation, LPE) at system level (NT AUTHORITY \SYSTEM). Let's take a look at the worst things in detail.
BlueHammer (The Defender Trick)
The nightmare began on 2 April 2026 with BlueHammer (CVE-2026-33825). The exploit directly attacks the Windows Defender update process.
- How it works: He uses a timing gap (Race Condition) via the Volume Shadow Copy Service (VSS), the Cloud Files API (clfs.sys) and so-called opportunistic file locks (oplocks). A normal user can use it to manipulate the signature database and screw the rights to the ceiling during the upgrade.
MiniPlasma (The Resurrection of an Ancient Spirit)
With MiniPlasma The researcher reactivated a vulnerability that had actually been considered patched for six years (CVE-2020-17103, Originally discovered by Google Project Zero.
- The problem: It concerns the Cloud Filter Driver (
cldflt.sys) – the system component responsible, for example, for OneDrive's Files On-Demand placeholder files. About the functionHsmOsBlockPlaceholderAccessThe exploit manipulates the registry (HKEY_USERS\.DEFAULT Hive) to enforce system rights. A damn elegant bypass of older patches.
RoguePlanet (When the Protector Becomes a Weapon)
Directly after the June patchday 2026 dropped, attacked RoguePlanet (CVE-2026-50656) The Windows Defender quarantine pipeline.
- The vulnerability: Since the Defender is allowed to delete or isolate malicious files system-wide, it runs with maximum privileges. RoguePlanet takes advantage of the freezing cold. The exploit intercepts the moment Defender creates a quarantine object, bends the path (Junction Point / Symlink) and forces the Defender to execute its own prepared payload with SYSTEM privileges. Microsoft attempted this in May.
mpengine!SysIO-Functions to be tacitly hardened. RoguePlanet was the direct answer that circumvented this protection.
LegacyHive (The Current Prank)
Brand new from this week (July 14, 2026): LegacyHive Windows User Profile Service.
The exploit makes it possible to load hives (registration databases) of other users, including admins! Exceptionally, the researcher here has slightly neutered the PoC (Proof of Concept) to complicate direct abuse in the wild, but the message is clear: “I am always one step ahead of you.”
Microsoft's behavioral patterns: Kill the messenger!
How does one of the world's most valuable tech companies react to such a PR and security disaster? With humility and fast patches? Of course not.
Instead of seeking dialogue with the dissatisfied ex-employee, Microsoft pulls out the legal and administrative club:
- GitHub lock: Microsoft (owner of GitHub) deleted Nightmare-Eclipse's account and blocked all its repositories.
- The GitLab move: What happened? The researcher just moved on. GitLab Um, called himself MSNightmare He continued to publish there unmoved.
- Legal threats: Microsoft tried to exert legal pressure. This only further stirred the anger of Nightmare-Eclipse. He even threatened to ‘symbolically smash’ Microsoft’s bones on 14 July (although he later defused this threat somewhat).
The fundamental problem here is: This Concept of Coordinated Vulnerability Disclosure (CVD) It is based on trust. When developers and researchers feel that corporations treat them condescendingly, block their accounts, or financially deprive them of their earned wages, the system collapses.
Microsoft behaved like a defiant child here. They block the channel on which the errors are shown, instead of fixing the blatant, sometimes years-old design weaknesses in the Windows kernel and the Defender. Deleting a GitHub account does not solve a kernel vulnerability. It just causes the exploit code to land uncontrollably on other platforms like in this example on GitLab. The problem now is that one defiant child has been joined by another.
The next stage of escalation? Not the yellow of the egg! If code ends up only on the darknet, where the blue teams of defenders get even harder, while the ransomware gangs already diligently access it will quickly zappenduster.
Why this is hell for us administrators
This feud is not just a popcorn movie. It has real, dangerous consequences:
- Weapon-ready exploits: IT security companies such as Huntress have already confirmed that the tools published by Nightmare-Eclipse (including BlueHammer, RedSun and UnDefend) were integrated into live attack chains by real threat actors.
- No CVEs, no patches: While we wait for patchdays, we stand there without protection. Since there are often no official CVE numbers or security updates for days, attackers who have gained local access can easily take full control of Windows 11 and Windows Server 2022/2025 systems.
- The Defender dilemma: The tool that is supposed to protect us (Windows Defender) becomes the primary gateway for privilege escalation due to the rabid behavior of Microsoft.
Conclusion: Time for a rethink
Microsoft must finally understand that they must treat security researchers (no matter how uncomfortable, noisy or how angry they are in this case) as fairly as possible and transparently. The ‘head-off’ mentality towards critics and whistleblowers is massively exacerbating the threat to all of us.
At the same time, however, I would also like to mention that, on the other hand, a manufacturer naturally has legitimate concerns about early disclosure and against publications that may have acted as a means of pressure. As always, it is not just black and white, but various pretty shades of gray. 😉
Until Microsoft learns that bug bounty platforms are not one-way streets, admins are left with only: Defense in Depth. Rigidly restricts local admin rights, implements least privilege, tamper protection, and application control. Also think of TTP: Monitors unusual file system activity (especially junctions/symlinks in the Defender directory) and suspicious manipulation of volume shadow copies. The event log is your friend. Oh, and definitely keep an eye on GitLab as well. Because the next patchday is coming and Nightmare-Eclipse is already waiting.