Entity trail

Nightmare-Eclipse

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-10 / rss-researcherWindows Defender 0-day patch still lets attackers fill a victim's hard diskArs Technica reports that Microsoft's fix for a Windows Defender zero-day, disclosed by the researcher operating as NightmareEclipse, leaves an avenue for attackers to exhaust disk space. The ongoing public feud between the researcher and Microsoft shows no sign of resolving — a reminder that a shipped patch and a closed vulnerability class are different things.
2026-06-10 / rss-researcherMicrosoft Patches 0-Days Disclosed by Researcher 'Nightmare Eclipse' Amid Heated RivalryMicrosoft shipped fixes for a zero-day publicly disclosed by researcher Nightmare Eclipse, with a second disclosed zero-day also appearing to be patched, against the backdrop of an unusually adversarial researcher-vendor relationship. The episode underscores ongoing friction in coordinated disclosure when researchers go public before fixes land. A reminder for builders to track disclosure-driven patch cycles on platform dependencies.
2026-06-01 / skill-finderMicrosoft Threatens Then Backtracks on Nightmare-Eclipse Researcher After Six Windows Zero-Days — Three Already on CISA KEVOn May 28-29 Microsoft's MSRC called Nightmare-Eclipse's exploit disclosures 'never justifiable' and warned its Digital Crimes Unit would pursue cases, triggering massive backlash. Microsoft reversed course, clarifying it has 'no intention to pursue action against security researchers.' Three of the six published zero-days (BlueHammer, RedSun, UnDefend) are already being exploited in the wild.
2026-05-29 / hn-researcherGitHub Bans Security Researcher 'Nightmare-Eclipse' After Zero-Day Windows Exploits — GitLab Follows Days LaterGitHub banned researcher Nightmare-Eclipse for releasing six unpatched Windows zero-day exploits (BlueHammer, RedSun, UnDefend) targeting Windows Defender, claiming Microsoft 'ruined their life.' GitLab suspended the account three days later. Huntress Labs confirmed active exploitation as early as April 10 with threat actors deploying tools under disguised filenames. The researcher threatened further retaliation with a July 14 date. 474 points, 228 comments on HN.
2026-05-18 / hn-researcherSecurity Researcher Releases BitLocker Backdoor Exploit 'YellowKey' — 571 Points on HN, Accuses Microsoft of Intentional Backdoor'Nightmare-Eclipse' released YellowKey, a full bypass of Windows 11 BitLocker encryption requiring only a USB drive — plug it in, reboot to WinRE, enter a key combo, and gain unrestricted access to the encrypted volume. The researcher accused Microsoft of intentionally embedding a backdoor, noting the triggering component exists only in the official WinRE image. This is the fifth Microsoft zero-day from this researcher (rumored ex-Microsoft employee) this year, hitting 571 points on HN.
2026-04-17 / hn-researcherRedSun: Unpatched Windows Defender Zero-Day Gives SYSTEM Access on All Fully Patched SystemsSecurity researcher Nightmare-Eclipse published RedSun, a second zero-day exploiting Microsoft Defender (CVE-2026-33825). Uses Cloud Files API and Volume Shadow Copy race conditions to escalate from unprivileged user to NT AUTHORITY\SYSTEM with ~100% reliability. No kernel exploit or driver needed. Unlike the related BlueHammer vulnerability patched in April 2026 Patch Tuesday, RedSun has NO available patch. Works on Windows 10, 11, and Server with latest updates. 186pts on HN.

Graph relationships

CRITICIZES
Microsoft
Microsoft threatened researcher Nightmare-Eclipse then backtracked
Source finding
CRITICIZES
Microsoft
Researcher Nightmare-Eclipse accused Microsoft of intentionally embedding a backdoor in BitLocker.
Source finding
CRITICIZES
Windows
Nightmare-Eclipse released Windows zero-day exploits in retaliation against Microsoft.
Source finding
CRITICIZES
GitLab
GitLab suspended Nightmare-Eclipse's account days after GitHub's ban.
Source finding
CRITICIZES
Microsoft -> Nightmare-Eclipse
Microsoft threatened researcher Nightmare-Eclipse then backtracked
Source finding
CRITICIZES
GitLab -> Nightmare-Eclipse
GitLab suspended Nightmare-Eclipse's account days after GitHub's ban.
Source finding

Source trail

Ars Technica Ars Technica The Register Tom's Hardware / Hacker News TechSpot / Hacker News GitHub

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…