Nightmare Eclipse reveals identity, posts Defender exploit

Abdelhamid Naceri, the researcher known online as Nightmare Eclipse, published a proof-of-concept called BigDiskBuster that he says prevents Windows Defender from completing platform and signature updates. The project appeared on his GitHub page over the weekend and is described as targeting all currently supported Windows versions.

On his GitHub page, Naceri described BigDiskBuster as ‘similar to UnDefend’ and able to ‘prevent Windows Defender from completing its platform and signature updates.’ He cautioned the code is buggy, experimental and requires further work, and he posted it as a proof of concept rather than finished attack code.

Naceri revealed his identity about a week before releasing BigDiskBuster. He has published multiple proof-of-concept exploits for Windows and Microsoft Defender in recent months and has previously used aliases including Chaotic Eclipse and MSNightmare. His vulnerability research was also reported in earlier coverage roughly five years ago.

In a public post on a now-deleted social account, Naceri wrote that he had worked for Microsoft in the United Kingdom and Germany and that the company terminated his employment abruptly without providing a clear justification. He said Microsoft offered several financial settlement options that he rejected because he sought a formal explanation and assistance to remain in Germany.

He wrote that he challenged the dismissal in a German labor court, alleging shifting arguments from the employer. By his account, the court upheld the termination and he received little compensation after a lengthy legal process.

Naceri wrote that the dispute had emotional and financial effects on his mental health and that he received treatment in a psychiatric hospital. He acknowledged that earlier public claims he had made about Microsoft taking legal action against him were fabricated and not accurate.

Microsoft was contacted for comment on BigDiskBuster and on Naceri’s account of his employment; no response had been published at the time of the disclosure.