#nightmareeclipse — Public Fediverse posts

(Re-)New Nightmare Eclipse stuff!

https://git.projectnightcrawler.dev/NightmareEclipse/ShieldBreak

Essentially RoguePlanet 2, it seems like.

#NightmareEclipse #Windows #Malware #Infosec #Microsoft

Microsoft Plugs Nearly 400 Security Holes

https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/

#MicrosoftPatchTuesdayAugust2026 #SANSTechnologyInstitute #NightmareEclipse #LatestWarnings #CVE-2026-62832 #CVE-2026-68820 #CVE-2026-72971 #SecurityTools #TimetoPatch #LandonMiles #1Password #EdSkoudis #afd.sys #Automox

On another news NightmareEclipse (the goat?) returned with a new PoC, after Microsoft failed to fully patch RoguePlanet (CVE-2026-50656), the current PoC only made for latest Windows 11 release, but they said that Windows 10 also still vulnerable. And yeah, it works even after the latest update

https://github.com/MSNightmare/ShieldBreak

#cybersecurity #infosec #zeroday #vulnerability #windows #nightmareEclipse

Maybe a bit of an explanation why it does this:

When a new user is logging on, Windows needs to load the users class hive. Since the user isn't logged on before logging on (tautology, I know), it can't be loaded in the context of the user. So it is loaded in the context of NT AUTHORITY\SYSTEM.

LegacyHive abuses this.

It messes with the Windows Object Manager and instead of the actual UsrClass.dat hive points at C:\randomGUID\UsrClass.dat. then it places an oplock on that file and starts an (interactive) logon for the user whose Object Manager path has been manipulated.
This leads Windows to try to open the file, but it can't, because of the Oplock. So the process looks at the Object Manager namespace again, finds a symlink (also manipulated by LegacyHive) and loads that instead, attaching it as the class hive for the user it is trying to create an interactive session for.
The load succeeds because, as I mentioned earlier, Windows falls back to NT AUTHORITY\SYSTEM when it doesn't have a user context yet.

Hope this makes at least some sense :blobcatgoogly2:

https://infosec.exchange/@kallisti/116924531318272148

#LegacyHive #NightmareEclipse

New blog post!

The title should be self-explanatory, it's an appreciation post for Nightmare Eclipse.

You might notice that the tone is a bit more emotional/angry than my usual style of writing.
This one's personal.

https://ti-kallisti.com/infosec/ms/nightmare-eclipse.html

#NightmareEclipse #Microsoft #Hackers #InfoSec #SecurityResearch #ChainsawMan #Reze

Nightmare Eclipse promised to drop something about Windows Defender bypass in July.

Sad side? Not sharing full PoC

https://blog.projectnightcrawler.dev/posts/2026-06-22-microsoft-is-an-interesting-company/

#cybersecurity #infosec #windows #windowsdefender #windowsdefenderBypass #zeroday #0day #nightmareEclipse

Der Security Forscher, der unter dem Namen Nightmare Eclipse oder Chaotic Eclipse bekannt ist, ist auf Grund von Zensur durch Google von Blogger zu Projectnightcrawler gewechselt.
Sein neuster Blogpost findet sich hier:
https://blog.projectnightcrawler.dev/posts/2026-06-15-some-updates-about-my-current-plans-and-more-about-the-recent-defender-exploits-rogueplanet-redsun-bluehammer/

#nightmareeclipse #chaoticeclipse #microsoft #microslop #security #zeroday

Looks like Nightmare Eclipse is in his limit.

If that's the case, thank you for your service, exposing how shitty MSRC is.

And how broken responsible disclosure in general.

I hope you get your justice, and we can improve as industry moving forward.

#cybersecurity #infosec #nightmareEclipse #windows #msrc

And on the note of #NightmareEclipse, here's another one for you.

Title: #Microsoft Defender 'RoguePlanet' zero-day grants SYSTEM privileges

Link: https://www.bleepingcomputer.com/news/microsoft/microsoft-defender-rogueplanet-zero-day-grants-system-privileges/

#Security #CyberSecurity

If you're curious about what happened to #NightmareEclipse, they have moved to their own privately hosted Git server since both Github and Gitlab booted them. You can check their repos out at:

https://git.projectnightcrawler.dev/

Just be aware that download protections in your browser may block some of the downloads, so you may have to disable that temporarily.

#Security #CyberSecurity

Another bitlocker vuln from yours truly, now called GreatXML.

Details below are copy pasted from NightmareEclipse readme:

Steps to reproduce:

1. If defender offline scan was initiated in the victim machine at any point then there is no need to login, the machine is automatically vulnerable. You will have to copy "unattend.xml" and "Recovery" directory to the root of the recovery partition then reboot to WinRE using shift + click on restart button, if everything was done correctly, a shell with unrestricted access to the bitlocker volume will spawn.

2 .If defender offline scan was never initiated then you have to either login and initiate it yourself or figure out a way to boot into WinRE in offline scan state (I believe it should be very possible to do so without logging in) and follow steps above.

Source and repo list:

https://deadeclipse666.blogspot.com/2026/06/greatxml-bitlocker-that-seems-to-only.html
https://github.com/MSNightmare/GreatXML

https://git.projectnightcrawler.dev/NightmareEclipse/GreatXML

https://git.churchofmalware.org/Nightmare_Eclipse/GreatXML

#cybersecurity #infosec #nightmareEclipse #greatxml #windows #zeroday #vulnerability #msrc

#NightmareEclipse is back on GitHub and with a new exploit!!

https://github.com/MSNightmare
https://github.com/MSNightmare/RoguePlanet

#GitHub #Tech #Technology #Microsoft #Windows #Security

NightmareEclipse's new Git home

NightmareEclipse | Security Researcher focusing on Microsoft

#NightmareEclipse #RoguePlanet #YellowKey #RedSun #MiniPlasma #YellowKey #BlueHammer #Undefend #GreenPlasma

Locked in heated rivalry with researcher, #Microsoft fixes 0-day they disclosed

Microsoft on Tuesday released fixes for two high-severity zero-days that were disclosed by a researcher who has been locked in a testy beef with the software giant.

#NightmareEclipse , the #pseudonym the researcher goes by, released a handful of high-severity #vulnerabilities in recent months, making them zero-days that had the potential to be #exploited in the wild. The researcher has said the disclosures, which included proof-of-concept code, came after Microsoft reneged on an arrangement the two made regarding vulnerabilities they had discussed.
#security #0day #zeroday

https://arstechnica.com/security/2026/06/locked-in-heated-rivalry-with-researcher-microsoft-fixes-0-day-they-disclosed/

Hey Windows (ab)users! Microsoft patched around 200 vulnerabilities in Windows etc today, a record Patch Tuesday batch. All indications are they fixed two of the zero-days dropped last month by the researcher Nightmare Eclipse, including "Green Plasma" and the "YellowKey" exploit that allowed local access to data encrypted by BitLocker. In response to today's Patch Tuesday, Nightmare Eclipse dropped an exploit for what they claimed was a zero-day bug in Windows Defender.

Nearly three dozen of the bugs patched this month earned Microsoft’s most dire “critical” rating, and exploit code for at least three of the weaknesses is now publicly available.

https://krebsonsecurity.com/2026/06/a-record-breaking-patch-tuesday-for-june-2026/

#patchtuesday #windows #nightmareeclipse #greenplasma #yellowkey

A Record-Breaking Patch Tuesday for June 2026

https://krebsonsecurity.com/2026/06/a-record-breaking-patch-tuesday-for-june-2026/

#InternetInformationServices #NightmareEclipse #VisualStudioCode #LatestWarnings #TheComingStorm #CVE-2026-45586 #CVE-2026-49160 #CVE-2026-50507 #SecurityTools #SatnamNarang #TimetoPatch #AdamBarnett #GreenPlasma #YellowKey #Tenable #Rapid7

Microsoft's Bug Bounty Betrayal Puts Everyone in Danger

In this video I discuss how Microsoft's refusal to pay out on bug bounties is dissolving trust between them and security researchers causing them to no longer take on bug bounties and in some cases just release public exploits for Microsoft's software.

https://www.youtube.com/watch?v=fL9HzADcTsY

#MS #MaliciousSoftware #exploits #NightmareEclipse

We will come to a point where you will make more money exploiting an undisclosed CVE than trying to parley with Microsoft Security Response Center.

https://www.youtube.com/watch?v=9kxx5xp5nTQ

You can make their team moving by simply disclosing publicly.

Or better, you don't use Microsoft products.

#Technology #CyberSecurity #CVE #Programming #Coding #Code #Security #Microsoft #MSRC #GitHub #NightmareEclipse

Nightmare-Eclipse's public github repos (2026-05-25) : Nightmare-Eclipse : Free Download, Borrow, and Streaming : Internet Archive

https://archive.org/details/nightmare-eclipse-repos

> Microslop wanted these repos gone. You can't kill a hydra, Microslop.
lic github repos that were published by Nightmare-Eclipse as of May 25th, 2026.

The 7zip (.7z) file in repos.zip contains the following Nightmare-Eclipse repos:

BlueHammer

GreenPlasma

MiniPlasma

RedSun

UnDefend

YellowKey

https://github.com/Nightmare-Eclipse

https://gitlab.com/nightmare-eclipse

https://cybernews.com/security/github-bans-researcher-releasing-windows-zero-days/

The password for the 7zip (.7z) file in repos.zip is the first word in this description box.

No data within the repos were altered in any way.

#nightmareeclipse #backup #repository #archiveorg

#Microsoft is under fire for threatening #securityresearcher #NightmareEclipse with legal action and criminal investigation after they publicly disclosed unpatched #vulnerabilities in Microsoft products. Nightmare Eclipse claims they were mistreated by Microsoft and had no choice but to disclose the vulnerabilities publicly. https://techcrunch.com/2026/05/29/microsoft-under-fire-for-threatening-security-researcher-with-criminal-investigation/?eicker.news #tech #media #news

#Babylon5 #microsoft #nightmareeclipse #infosec #fulldisclosure

Scheinbar die neue Microsoft-Zero-Day-Strategie 2026:
1. Sicherheitslücken nicht oder unzureichend patchen ✅
2. GitHub-Konto des Reporters löschen ✅
3. Mit Strafverfolgung drohen ✅
4. MSRC-Konto des Reporters sperren & Fragen ignorieren ✅
Kein Patch, dafür ein Anwalt und beim MSRC, das mal einen guten Ruf hatte, spart man lieber am kompetenten Personal.
#Microsoft #Security #ZeroDay #NightmareEclipse
https://www.heise.de/news/Zu-viele-Zero-Days-Microsoft-droht-mit-Gericht-11310723.html

Da rappelt es: Das GitLab-Konto von #NightMareEclipse wurde auch gesperrt und #Microsoft schreibt, dass die "unkoordinierte" Offenlegung von Schwachstellen nicht toleriert werde. Öl ins Feuer gießen, wenn Deeskalation angesagt wäre?

https://borncity.com/blog/2026/05/28/nightmare-eclipse-auf-gitlab-gebannt-microsoft-nimmt-stellung/

annnnnd #NightmareEclipse's gitlab account was just banned. what was that? 2 days?

#NightmareEclipse reagiert auf #Microsoft Vorwürfe, gegen verantwortliche Offenlegungsverfahren zu verstoßen. Hat etwas von Rezzo "Zerstörung der CDU" und am 14. Juli soll es den großen Knall geben ... zieht euch warm an.

https://borncity.com/blog/2026/05/25/zoff-und-schwarze-peter-spiel-zwischen-microslop-und-chaotic-eclipse/

NightmareEclipse: yes the one who dropped Microsoft zero days threatened to drop something on July 14th.

I wait your keeping annihilation of Microsoft 0days sir.

https://deadeclipse666.blogspot.com/2026/05/july-14th.htm

Their new repo bcz Github flagged/deleted it: https://gitlab.com/nightmare-eclipse

#NightmareEclipse #microsoft #0day #cybersecurity #infosec