The researcher known online as Nightmare Eclipse, who has spent months publishing a rapid string of Windows and Microsoft Defender proof-of-concept exploits, has revealed his identity and released another Defender exploit.
Posting under the name Abdelhamid Naceri, the researcher announced a new PoC exploit called BigDiskBuster over the weekend.
According to the project’s GitHub page, BigDiskBuster is a proof of concept “similar to UnDefend” that prevents Windows Defender from completing its platform and signature updates.
He describes it as working on all currently supported Windows versions, while cautioning that the code is still buggy and needs further work.
SecurityWeek has reached out to Microsoft for comment on the BigDiskBuster exploit and will update this article if the company responds.
Nightmare Eclipse is Abdelhamid Naceri
About a week before releasing BigDiskBuster, Nightmare Eclipse, also known online as Chaotic Eclipse and MSNightmare, claimed that he is Abdelhamid Naceri, a researcher whose vulnerability discoveries were featured in the news half a decade ago.
Naceri shared a public account of his departure from Microsoft on an X account that has since been deleted.
According to Naceri’s account, he worked with Microsoft in the UK and Germany. Microsoft allegedly terminated his employment abruptly and without providing a clear justification. He alleged that the company offered him several financial settlement options to resolve the dispute, all of which he claims to have rejected because he sought a formal explanation and assistance remaining in Germany.
Naceri also claimed that he challenged his dismissal in a German labor court, alleging that Microsoft presented shifting arguments throughout the proceedings. By his own account, the court ultimately upheld the termination, leaving him with virtually no compensation after a prolonged and costly legal effort.
Naceri said the emotional and financial fallout from the dispute severely impacted his mental health, claiming he was receiving treatment in a psychiatric hospital.
The researcher admitted that previous claims that Microsoft filed legal action against him — a claim made while Microsoft faced backlash over threats of legal action against researchers who disclose zero-days — were fabricated.
UPDATE, September 26: Microsoft shared the following statement with SecurityWeek regarding the BigDiskBuster exploit:
“Microsoft Defender Antivirus detects ‘BigDiskBuster’ and includes both detection and prevention for observed activity. Customers should keep Microsoft Defender security intelligence and platform updates current and update to the latest available security intelligence.”
Related: Nightmare Eclipse Drops ‘HardBreacher’ Kaspersky Product Exploit
Related: Recent ZyXEL Switch Vulnerability Exploited by Chinese Hackers
Related: Nightmare Eclipse Drops CrowdStrike, Nvidia, Avast Zero-Day Exploits
