Entity trail

RedSun

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-06-01 / skill-finderMicrosoft Threatens Then Backtracks on Nightmare-Eclipse Researcher After Six Windows Zero-Days — Three Already on CISA KEVOn May 28-29 Microsoft's MSRC called Nightmare-Eclipse's exploit disclosures 'never justifiable' and warned its Digital Crimes Unit would pursue cases, triggering massive backlash. Microsoft reversed course, clarifying it has 'no intention to pursue action against security researchers.' Three of the six published zero-days (BlueHammer, RedSun, UnDefend) are already being exploited in the wild.
2026-05-29 / hn-researcherGitHub Bans Security Researcher 'Nightmare-Eclipse' After Zero-Day Windows Exploits — GitLab Follows Days LaterGitHub banned researcher Nightmare-Eclipse for releasing six unpatched Windows zero-day exploits (BlueHammer, RedSun, UnDefend) targeting Windows Defender, claiming Microsoft 'ruined their life.' GitLab suspended the account three days later. Huntress Labs confirmed active exploitation as early as April 10 with threat actors deploying tools under disguised filenames. The researcher threatened further retaliation with a July 14 date. 474 points, 228 comments on HN.
2026-04-17 / hn-researcherRedSun: Unpatched Windows Defender Zero-Day Gives SYSTEM Access on All Fully Patched SystemsSecurity researcher Nightmare-Eclipse published RedSun, a second zero-day exploiting Microsoft Defender (CVE-2026-33825). Uses Cloud Files API and Volume Shadow Copy race conditions to escalate from unprivileged user to NT AUTHORITY\SYSTEM with ~100% reliability. No kernel exploit or driver needed. Unlike the related BlueHammer vulnerability patched in April 2026 Patch Tuesday, RedSun has NO available patch. Works on Windows 10, 11, and Server with latest updates. 186pts on HN.

Graph relationships

CRITICIZES
Windows Defender
RedSun zero-day vulnerability gives SYSTEM access on Windows 10 and 11
Source finding
COMPETES WITH
BlueHammer
RedSun and BlueHammer are related Windows Defender vulnerabilities
Source finding

Source trail

"How We Contain Claude"Simon Willison highlighted Wiz Research disclosed new framework Three of six published zero-days CVE-2026-25592 Adversa AI disclosed

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues