Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Serhii Melnyk
BlackApex, SPY, and Counting: The Emerging Wave of Vibe-Coded Phishing Kits
October 30, 2026 10 Minute Read by Serhii Melnyk, Cris Tomboc and King Orande Anyone who has signed in to a streaming app on a smart TV by typing a short code into a phone has used a device code flow. Microsoft supports the same mechanism for Microsoft 365 accounts, and attackers have turned it against the people it was designed to help.
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
A new proof of concept called BigDiskBuster, published on GitHub on September 19, 2026, by the actor known as MSNightmare, shows that Defender doesn't need to be disabled to stop receiving updates, it just needs a much simpler dependency: disk space. UnlikeShieldCrash, which relied on a Windows path-resolution flaw, BigDiskBuster requires no vulnerability.
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed
In ourprevious blog, we analyzed four proofs of concept (PoCs) from the leak persona Nightmare-Eclipse that targeted Kaspersky, Avast, NVIDIA, and CrowdStrike, respectively. Nightmare-Eclipse has now returned to the product where that theme started. Immediately following Microsoft's September 2026 Patch Tuesday, the actor released ShieldCrash, a Windows Defender privilege-escalation bypass — and the third entry in a lineage we've been tracking since our coverage of ShieldBreak.
Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs
In ourprevious blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality. In this article, we analyze HardBreacher, PrettyPrague, GreenSection, and FalconFlank, assessing their implementation, practical impact, detection opportunities, and relevance to enterprise defenders.
Still Circling: Inside the Operator Behind Blind Eagle's GitHub Loader
August 28, 2026 10 Minute Read by Serhii Melnyk This is a collaborative follow-up to our original post, developed jointly with Emmanuel C., an independent security researcher not affiliated with LevelBlue, who contributed additional infrastructure and tooling findings based on an analysis of the same GitHub staging account.
Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking
FollowingGreenPlasma, YellowKeyand MiniPlasma,RoguePlanet and GreatXML, andLegacyHive, the Nightmare-Eclipse disclosure actor has published ShieldBreak — its latest Windows proof of concept (PoC) released shortly after Microsoft's August 2026 Patch Tuesday. Like its predecessors, ShieldBreak explores a different corner of the Windows operating system.
LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation
FollowingGreenPlasma,YellowKey and MiniPlasma, as well asRoguePlanet and GreatXML, the Nightmare-Eclipse disclosure actor has publishedLegacyHive, its latest Windows proof-of-concept (PoC) released shortly after Microsoft's July 2026 Patch Tuesday. Like its predecessors, LegacyHive explores a different corner of the Windows operating system, this time focusing on profile initialization and registry hive loading rather than introducing a traditional software vulnerability.
Exploitarium: Inside the Archive Behind the Mass 0-Day Drop
Coordinated vulnerability disclosures operate on a straightforward premise: the affected vendor is notified first, given a defined window to remediate, and public disclosure follows. That norm has been tested twice within the past several weeks by uncoordinated, mass proof-of-concept (PoC) releases. The more recent of the two, an archive published by a GitHub account operating as “bikini” under the name exploitarium, is the subject of this assessment.
Still Circling: Blind Eagle's Toolkit Keeps Evolving
In June 2025, LevelBlue SpiderLabs publishedTracing Blind Eagle to Proton66, in which we assessed with high confidence that Blind Eagle (also tracked as APT-C-36, APT-Q-98, TAG-144, AguilaCiega), a threat actor focused on Latin America, had moved part of its VBScript delivery infrastructure onto the Russian bulletproof hosting provider Proton66. A year later, we're still tracking this cluster closely, and the group hasn't slowed down. If anything, it has kept building.
RoguePlanet and GreatXML: Detecting Local Privilege Escalation and BitLocker Security Boundary Abuse
Following ourprevious research, LevelBlue SpiderLabs continued monitoring a series of Windows security component disclosures published under multiple online aliases, including Nightmare-Eclipse, Chaotic Eclipse, Dead Eclipse, and most recently MSNightmare. Shortly after Microsoft’s June 2026 Patch Tuesday release, a new proof‑of‑concept (PoC) named RoguePlanet was published targeting Microsoft Defender on fully patched Windows 10 and Windows 11 systems.
Safe Observability: A Framework for Automated PII Redaction from LLM Prompts in OpenTelemetry Pipelines
Keywords: Large Language Models, OpenTelemetry, Safe Observability, PII-Redaction References [1] J. Turner. “What is Observability? Beyond Logs, Metrics, and Traces.” Internet: https://www.strongdm.com/observability, Oct. 23, 2025 [accessed Oct. 2, 2025].
Scattered LAPSUS$ Hunters: Anatomy of a federated cybercriminal brand
Skip to content SPECIAL INSIDE THE CHINA THREAT | READ MORE → Powered by the McCrary Institute at Auburn University Get your cyber briefing Straight from our experts to your inbox
The New Face of Ransomware: Key Players and Emerging Tactics of 2024
As we step into 2025, the high-impact, financially motivated ransomware landscape continues to evolve, shaped by a combination of law enforcement actions, shifting affiliate dynamics, advancements in defensive approaches, and broader economic and geopolitical influences. While 2024 also saw the continued use of ransomware for non-financial gain purposes, such as drawing attention away from other activities – financial motives remained at the forefront of the overall ransomware landscape.
It’s Time for Publishers to Establish Value, Not Paywalls
An April report from the World Economic Forum, “Understanding Value in Media,” states that the proportion of people saying they would be willing to pay for media in the future is on the rise. The WEF found that, for news, 53% of respondents said they would be willing to pay in the future, versus the 16% who pay today. Perhaps even more relevant for publishers, 35% of respondents agreed that they should be responsible for paying for – or funding access to – news.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Serhii
Contact Serhii, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack