Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Timmy Lister
Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
A new proof of concept called BigDiskBuster, published on GitHub on September 19, 2026, by the actor known as MSNightmare, shows that Defender doesn't need to be disabled to stop receiving updates, it just needs a much simpler dependency: disk space. UnlikeShieldCrash, which relied on a Windows path-resolution flaw, BigDiskBuster requires no vulnerability.
One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed
In ourprevious blog, we analyzed four proofs of concept (PoCs) from the leak persona Nightmare-Eclipse that targeted Kaspersky, Avast, NVIDIA, and CrowdStrike, respectively. Nightmare-Eclipse has now returned to the product where that theme started. Immediately following Microsoft's September 2026 Patch Tuesday, the actor released ShieldCrash, a Windows Defender privilege-escalation bypass — and the third entry in a lineage we've been tracking since our coverage of ShieldBreak.
Expanding the Attack Surface: Analyzing Nightmare-Eclipse's Latest PoCs
In ourprevious blog, we explored a series of disclosures from the leak persona Nightmare-Eclipse that focused heavily on Microsoft's ecosystem, including Windows Defender, Cloud Files, and core operating system functionality. In this article, we analyze HardBreacher, PrettyPrague, GreenSection, and FalconFlank, assessing their implementation, practical impact, detection opportunities, and relevance to enterprise defenders.
Cloud Sync Root RegistrationShieldBreak: Hunting Windows Defender Remediation Abuse and Cloud Files Hijacking
FollowingGreenPlasma, YellowKeyand MiniPlasma,RoguePlanet and GreatXML, andLegacyHive, the Nightmare-Eclipse disclosure actor has published ShieldBreak — its latest Windows proof of concept (PoC) released shortly after Microsoft's August 2026 Patch Tuesday. Like its predecessors, ShieldBreak explores a different corner of the Windows operating system.
LegacyHive: Hunting Windows Profile Initialization Abuse Through Offline Registry Manipulation
FollowingGreenPlasma,YellowKey and MiniPlasma, as well asRoguePlanet and GreatXML, the Nightmare-Eclipse disclosure actor has publishedLegacyHive, its latest Windows proof-of-concept (PoC) released shortly after Microsoft's July 2026 Patch Tuesday. Like its predecessors, LegacyHive explores a different corner of the Windows operating system, this time focusing on profile initialization and registry hive loading rather than introducing a traditional software vulnerability.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Timmy
Contact Timmy, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack