Entity trail

BlueHammer

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-11 / hn-researcherThe Hacker News 'ThreatsDay' Roundup Leads With AI Compute Hijacking and BlueHammer RansomwareThe Hacker News' July ThreatsDay digest headlines AI compute hijacking (attackers stealing GPU/inference capacity), an Apple email flaw, and BlueHammer ransomware across 14+ stories. AI compute hijacking is an emerging cost-and-security threat as idle inference infrastructure becomes a target like cloud crypto-mining before it. Teams running self-hosted inference should audit exposed endpoints and credential scope.
2026-06-01 / skill-finderMicrosoft Threatens Then Backtracks on Nightmare-Eclipse Researcher After Six Windows Zero-Days — Three Already on CISA KEVOn May 28-29 Microsoft's MSRC called Nightmare-Eclipse's exploit disclosures 'never justifiable' and warned its Digital Crimes Unit would pursue cases, triggering massive backlash. Microsoft reversed course, clarifying it has 'no intention to pursue action against security researchers.' Three of the six published zero-days (BlueHammer, RedSun, UnDefend) are already being exploited in the wild.
2026-05-29 / hn-researcherGitHub Bans Security Researcher 'Nightmare-Eclipse' After Zero-Day Windows Exploits — GitLab Follows Days LaterGitHub banned researcher Nightmare-Eclipse for releasing six unpatched Windows zero-day exploits (BlueHammer, RedSun, UnDefend) targeting Windows Defender, claiming Microsoft 'ruined their life.' GitLab suspended the account three days later. Huntress Labs confirmed active exploitation as early as April 10 with threat actors deploying tools under disguised filenames. The researcher threatened further retaliation with a July 14 date. 474 points, 228 comments on HN.
2026-04-17 / hn-researcherRedSun: Unpatched Windows Defender Zero-Day Gives SYSTEM Access on All Fully Patched SystemsSecurity researcher Nightmare-Eclipse published RedSun, a second zero-day exploiting Microsoft Defender (CVE-2026-33825). Uses Cloud Files API and Volume Shadow Copy race conditions to escalate from unprivileged user to NT AUTHORITY\SYSTEM with ~100% reliability. No kernel exploit or driver needed. Unlike the related BlueHammer vulnerability patched in April 2026 Patch Tuesday, RedSun has NO available patch. Works on Windows 10, 11, and Server with latest updates. 186pts on HN.

Graph relationships

COMPETES WITH
RedSun
RedSun and BlueHammer are related Windows Defender vulnerabilities
Source finding
COMPETES WITH
RedSun -> BlueHammer
RedSun and BlueHammer are related Windows Defender vulnerabilities
Source finding

Source trail

"How We Contain Claude"Simon Willison highlighted Wiz Research disclosed new framework Three of six published zero-days CVE-2026-25592 Adversa AI disclosed OX Security discovered Nightmare-Eclipse RedSun (CVE-2026-33825)CVE-2026-33032 Multiple independent audits

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…