Nightmare Eclipse Has a Name Now and ShieldCrash Broke Microsoft’s Defender Patch in Two Hours

Nightmare Eclipse has been dropping Windows zero-days since April, and this weekend he signed his own name under them. Microsoft fired him. His GitHub bio still reads I love Microsoft.

The name is Abdelhamid Naceri. He worked at the Microsoft Security Response Center in Germany, the team that takes in vulnerability reports from outside and decides what happens with them. This weekend he posted a long thread on X titled Story time, with his dismissal paperwork in it. That ended five months of guessing.

I have been writing about him since April. BlueHammer, RedSun, UnDefend, YellowKey, MiniPlasma, RoguePlanet, GreatXML, LegacyHive, ShieldBreak. Nine articles. In the last one I wrote that the trail ran through Microsoft’s own credit page and stopped at a profile, and that I was not going to write it as a confirmation. He has now confirmed it himself.

The thread is not the reason I am writing today. What he put online five days before it is.

On September 8, Microsoft shipped its September Patch Tuesday updates. Roughly two hours later the code for a new exploit went up on his GitHub, called ShieldCrash. The repository itself had been created the day before and sat there empty until the patches landed. His words, from the page:

“Microsoft has failed to properly patch ShieldBreak CVE-2026-69414, under specific conditions it is still possible to trigger the exact same problem that was caused by ShieldBreak.”

ShieldBreak was his August one, the Defender flaw that lifts an ordinary account to SYSTEM, the highest level of access a Windows machine has. Microsoft gave it CVE-2026-69414 on August 14 and rated it 7.8. ShieldCrash says the fix for it did not hold.

Windows has a feature for files that live in the cloud but show up in your folders as if they were on your disk. The file is a placeholder until you open it. Then Windows pulls the contents down. The part of Windows that handles this is called the Cloud Filter API. It lets the software that owns the file decide what data comes back when something reads it.

ShieldCrash registers itself as one of those cloud providers, under the name Flubber. It creates a placeholder file called BERN and puts the EICAR test string in it, the harmless string antivirus products are built to flag. Then it copies ntdll.dll into an alternate data stream on that same file, a hidden second set of contents that NTFS lets a file carry behind its name, after a colon.

Then it goes and fetches Defender. It loads Defender’s own MpClient.dll straight out of the installation folder, opens the interface behind it and starts the scan itself, on the path it built. Defender finds the EICAR string, decides the file is malicious and begins cleaning up, and the exploit kicks off that cleanup too. Cleanup runs with SYSTEM rights. And while Defender is walking toward the file it is about to remove, the exploit pulls the path out from under it and points it at a different file.

Which file is up to whoever runs the tool. The usage line in the source is Usage : ShieldCrash.exe <path_to_leak>. In the demo that path is C:\Windows\System32\config\SAM, and that file holds the password hashes for the accounts on the machine. Windows keeps it locked while the system is running, and a normal user cannot read it. Defender can.

So the risk sits on the machines running the protection they were told to run. Defender has to be enabled for any of this to work. That is not an argument for switching it off, and switching it off costs you far more than it buys. Software that runs as SYSTEM is worth attacking precisely because it runs as SYSTEM. That includes the software guarding the machine.

Several outlets have the patch wrong.

The headlines say the September Patch Tuesday updates patched ShieldBreak and that he broke them two hours later. Those updates have nothing to do with it. Microsoft’s own advisory gives the first patched engine as 1.1.26080.3. That is the Malware Protection Engine, the scanning engine inside Defender, and it updates itself on its own schedule, separately from the monthly updates that arrive through Windows Update. The advisory was last revised on September 3. The patch he went after had been out for days, and it never came down as a KB number at all.

He also says less about his own exploit than the headlines do.

The articles describe ShieldCrash as granting SYSTEM access. On his own page he calls it a skeleton PoC and says he is dropping it with limited motivation. What is there right now is an arbitrary file read as SYSTEM. He might rework it later into a full SYSTEM proof of concept, he writes. That is a researcher saying his own exploit is not finished.

And someone checked. Howler Cell rebuilt the chain on Windows 11 25H2, build 26200.9445, with the patched engine 1.1.26080.3 installed, and walked it stage by stage. It got three stages in and stopped. The redirect fails with Windows error 145, ERROR_DIR_NOT_EMPTY, because Defender is holding a log file open in the directory the exploit needs to modify. Their sharpest observation is in the output: each run produced a file of exactly 2,505,480 bytes, the length of ntdll.dll on that machine. The exploit was handing back the copy it had planted itself, not the password file it was aiming at.

That is one reproduction, and it is not the final word. A proof of concept that fails today is not a hole that is closed. His first one, BlueHammer, started out exactly the same way.

Microsoft has not confirmed ShieldCrash, has not assigned it a number, and has not announced a fix. What it said when asked was this: “antimalware software must be kept up to date with these updates in a timely manner.” That sentence is thirteen years old. It sits word for word in Microsoft’s own Malware Protection Engine advisories from 2013, 2014 and 2017, under the same two headings the ShieldBreak advisory uses: last engine version affected, first engine version fixed. Same form, different numbers.

Something else changed in the last three weeks and it got almost no attention. Four of his last five releases are not about Microsoft at all.

• → HardBreacher, August 28, Kaspersky Endpoint Security v14.0.0.504. It redirects which DLL the interface loads, using the same Object Manager naming trick.
• → GreenSection, August 29, the NVIDIA display driver. A shared memory section created with full access for any account on the box.
• → PrettyPrague, August 30, Avast. It abuses the sandbox’s own filesystem virtualization to pull out the SAM hive and recover the credentials offline.
• → FalconFlank, September 3, CrowdStrike Falcon Sensor. A timing race through Transactional NTFS that swaps a legitimate file for a payload at the moment the sensor acts on it.

Kevin Beaumont tested them and confirmed that three of the four work, all but GreenSection, which he read as a crash rather than a privilege escalation. Gen Digital confirmed the flaw in its own product and had corrected builds out on September 4. Kaspersky says it was resolved through an automatic database update. NVIDIA has published nothing. CrowdStrike is still investigating, and in the meantime tells customers to switch off the Microsoft Office File Suspicious Macro Removal policy in Windows. Of the four, that is the only one that tells people to go and change a setting.

Four security products, three of them inside three days, from one person, with no coordination with any of the vendors.

This is where it stops being a dispute between a man and a company. BlueHammer carries the number CVE-2026-33825. Huntress saw it used in a live intrusion starting April 10, 2026, in a network that had nothing to do with his fight. Microsoft patched it in April, and CISA added it to the catalogue of flaws known to be exploited later that month. Before the summer was over, CISA had updated the entry to say ransomware crews were using it.

What it does after it gets its foothold connects straight to something that was back in the news this week. The SAM file is locked by the System process. So the exploit writes an antivirus test string to disk, the kind Defender is certain to flag, and Defender responds by taking a frozen snapshot of the volume as part of cleaning up. That snapshot contains an unlocked copy of the password file, and the exploit sits and waits for it to appear. The security software does the heavy lifting and the attacker walks in behind it.

Then it parses the SAM and decrypts each user’s NT hash. It sets each password on the box to $PWNed666!!!WDFAIL, opens admin sessions with those, copies the SYSTEM token and walks out with full control.

The same shadow copy feature is what ransomware crews delete before they encrypt, so nothing can be restored. Backup software uses it too, which is exactly why it is hard to alarm on.

The intrusion itself reads like a bad day at a normal company. On April 15, 2026 at 13:44:19 UTC, the attacker came in over an SSL VPN from 78.29.48.29, in Russia. Reconnaissance was whoami /priv, cmdkey /list and net group. The tools sat in the user’s Pictures folder under the name FunnyApp.exe.

And when the attacker went to run UnDefend to knock Defender over, he typed his own parameter wrong. He wrote -agressive with one g, and the tool did not do what he wanted. RedSun and UnDefend were patched out of band on May 21 as CVE-2026-41091 and CVE-2026-45498, after Huntress confirmed all three in live attacks.

The account you can visit today is not his first. GitHub suspended the original Nightmare-Eclipse account on May 23 and wiped everything on it. GitLab, where he moved next, closed his account on May 26 and wiped that too. The GitHub API still returns a 404 for the old name.

What the takedowns did was get him off other people’s platforms. He runs his own git server now, at projectnightcrawler.dev, and BlueHammer, RedSun, UnDefend, YellowKey, MiniPlasma, GreenPlasma and RoguePlanet are all sitting on it. Fifteen repositories, on hardware he owns himself.

On June 8 he came back to GitHub under a new name, and the first exploit went up the next day, June 9, which was that month’s Patch Tuesday. The account is called MSNightmare, the display name is INFINITE NIGHTMARE, the location field says Redmond, and the bio is three words:

1

I love Microsoft.

It has 3,804 followers and ten repositories, and it has been sitting there for three months. RoguePlanet has 1,670 stars on it. ShieldBreak has 731, GreatXML 663, FalconFlank 611.

The paperwork behind all of this is public because he published it himself. On September 20, 2024 he received a message from Tom Gallagher, the vice president of engineering at MSRC. It told him Microsoft had identified a security issue and that he had put the company at risk by sharing vulnerability information with people outside it. The formal dismissal letter is dated March 3, 2025.

He took it to the labour court in Cologne and fought it for about two years. He says it cost him more than $200,000, and that he turned down a settlement of €55,000 plus a year’s pay because what he wanted was not money. He wanted help staying in Germany, where he was months away from permanent residence. The court upheld the dismissal. He walked away with almost nothing, and he says he is now receiving psychiatric treatment. His own summary: “they fired me for no reason, it was never abount bounties.”

Whatever you make of how he chose to fight, the thing underneath it is older and bigger than him. Bug hunters carry the risk, do the hard part, hand the result over and get treated as an afterthought. I have watched it happen to people I know and it has happened to me, at more than one company and not only at Microsoft. That is why people who disagree with his methods still recognise what he is angry about.

For your own machine, look at the engine version. Open PowerShell and run:

1

Get-MpComputerStatus

Look at AMEngineVersion in the output. Anything below 1.1.26080.3 and the ShieldBreak fix never reached that machine. Defender normally updates this by itself. If it is behind, something on that machine is stopping it, and you want to know what today.

• → AMEngineVersion below 1.1.26080.3 means the August flaw is still open on that machine
• → Defender turned off stops the ShieldCrash chain and opens everything else
• → Any process other than MsMpEng.exe or MpCmdRun.exe loading MpClient.dll
• → A cloud sync provider registered by an unsigned file, or from outside the user profile
• → A volume snapshot appearing on a machine that runs no backup job
• → An account whose password changed and changed back inside the same hour

You can walk the same climb on a Windows VM at home: a low-privilege account, an enumeration pass, and the settings that hand out SYSTEM. My Ethical Hacking Complete Course Zero to Expert takes you there step by step: reconnaissance, scanning, exploitation and traffic analysis, hands-on, from your first day with no Linux or hacking background.

→ Join my complete ethical hacking course

Hacking is not a hobby but a way of life.

Sources:

ShieldCrash proof of concept | MSRC advisory CVE-2026-69414 | Huntress intrusion analysis | Howler Cell ShieldCrash reproduction | Microsoft Security Advisory 2846338