Nightmare Eclipse vs. Microsoft: six weeks, eight zero-days, one grudge

I don’t do surprises — but Microsoft apparently does.

Between April and June 2026, a researcher publishing under Nightmare-Eclipse and Chaotic Eclipse dropped a wave of working Windows zero-day proofs-of-concept on GitHub, each timed so the next Patch Tuesday had already shipped and defenders would wait weeks for a fix. Some exploits were exploited in the wild before patches existed. At least three were confirmed in Huntress incident response within days of publication.

This is the scorecard, the naming scheme, and why the disclosure story matters as much as the bugs.

“Someone violated our agreement”

The Register quoted the researcher’s maiden Chaotic Eclipse blog post:

“I never wanted to reopen a blog and a new GitHub account to drop code… But someone violated our agreement and left me homeless with nothing. They knew this will happen and they still stabbed me in the back anyways — this is their decision not mine.”

Whether you sympathize with that narrative or not, the operational consequence is identical: public PoC code shrinks the window between discovery and exploitation to zero, and several of these bugs were weaponized almost immediately.

Barracuda, Fortified Health Security, and others tracked the campaign as retaliatory against MSRC process. Rumors of a former Microsoft employee behind the handle circulated; I am not going to treat that as confirmed identity — what is confirmed is Huntress saw the tooling in real intrusions.

GitHub and GitLab later removed the researcher’s accounts and repos. PoCs forked fast. Assume copies exist indefinitely.

The color-coded release calendar

Nightmare-Eclipse names exploits like a paint swatch catalog at a trauma ward:

Timing pattern: BlueHammer landed April 2. YellowKey and GreenPlasma landed May 13 — one day after May Patch Tuesday. MiniPlasma followed May 17. RoguePlanet and GreatXML appeared around June 9–10, again just after a patch cycle.

If you plan security work around “we’ll get it next Tuesday,” this researcher treats that schedule as a countdown timer.

The ones that actually burned people

BlueHammer (CVE-2026-33825)

Defender local privilege escalation. Novel primitives for arbitrary read against the SAM database via Volume Shadow Copy abuse paths. Public PoC April 2; Microsoft patched April 14; Huntress observed exploitation as early as April 10 — before the patch.

CISA KEV. Later flagged as exploited by ransomware gangs. This is the release that proved the campaign was not theoretical.

RedSun (CVE-2026-41091)

Sibling technique to BlueHammer — different path, same destination (SYSTEM). Hijacks the Storage Tiers Management Engine COM object to overwrite TieringEngineService.exe in System32 with attacker-controlled code.

Huntress saw RedSun.exe in the same compromised SSLVPN user session as BlueHammer and UnDefend attempts (April 16, 2026). EICAR alerts fired as part of the technique — noisy on purpose or by accident, depending who you ask.

UnDefend

Not elevation — denial of hygiene. Standard user can interfere with Defender definition updates. In a chain with VPN access + other LPE attempts, that’s “stay resident longer,” not a party trick.

The May drop: encryption and plasma

YellowKey

BitLocker bypass through WinRE Transactional NTFS replay against winpeshl.ini. Physical access, TPM-only machines, cmd.exe with the volume already decrypted.

Full teardown in the companion draft: YellowKey: BitLocker wasn’t the boundary — WinRE was the door.

Microsoft’s advisory literally scolded the public PoC drop while issuing mitigations — a sentence you don’t see every quarter.

GreenPlasma (CVE-2026-45586)

Targets CTFMON — the text-input helper that runs as SYSTEM in interactive sessions. Manipulates registry and object-manager ACLs so an unprivileged user plants a memory section object where only SYSTEM should write, then tricks CTFMON into touching it.

The published repo was deliberately incomplete (“creates the section object; you finish the weaponization”). Incomplete PoCs still shorten attacker R&D — especially against a process that already runs as SYSTEM on every desktop session.

MiniPlasma

Abuses the Cloud Files Mini Filter Driver (cldflt.sys). The spicy detail: regression of CVE-2020-17103, a flaw reported and supposedly fixed years ago. Google’s 2020 Project Zero PoC reportedly still worked on fully patched Windows 11 in May 2026 until June Patch Tuesday.

That is not “Microsoft bad” blog spam — that is “your regression test suite for kernel drivers is a business continuity issue.”

What defenders should do (practical, boring, correct)

1. June 2026 Patch Tuesday is not optional — YellowKey, GreenPlasma, MiniPlasma land here.
2. Defender platform ≥ 4.18.26050.3011 (or whatever your vendor doc specifies this week) — RedSun / UnDefend path.
3. BlueHammer KEV — if you are federal or KEV-aligned, you already missed the deadline; catch up.
4. YellowKey WinRE mitigation script — even post-patch, verify BootExecute does not resurrect autofstx.exe after WinRE updates.
5. TPM+PIN on mobile assets — Microsoft’s stated YellowKey fix; keep firmware admin passwords where you can.
6. Monitor for Nightmare-Eclipse filenames — RedSun.exe, EICAR-adjacent Defender alerts, unusual COM/tiering service writes. Huntress published IOC-style guidance in April.

The meta-lesson (native security is not one control)

ThreatLocker summarized it cleanly: YellowKey and GreenPlasma attack different trust anchors — full-disk encryption’s recovery path vs. a ubiquitous SYSTEM process — but the same mistake: treating a native Windows component as a complete boundary by itself.

BitLocker still stops casual theft. Defender still stops casual malware. Neither survives “researcher with a grudge + GitHub + two weeks until Patch Tuesday” without layered controls:

• EDR that is not the product being exploited

• Application control on servers and high-value endpoints

• Assume physical access and local admin scenarios in threat models

• Patch cadence measured in days for KEV-class bugs, not “next maintenance window”

Pay your bug-bounty contributors

I will say the quiet part out loud: whether or not the researcher’s MSRC grievance is fully fair, dropping eight PoCs is what happens when the coordinated disclosure handshake breaks. MSRC process exists precisely so this does not become the default outcome.

Microsoft’s response mixed mitigations, CVE assignment, scolding about disclosure ethics, and eventual patches — sometimes in that order. Enterprises live in the gap.

If you are a vendor: treat researcher burnout and broken trust as supply-chain risk.

If you are a defender: the gap is your problem, not MSRC’s press release schedule.

Further reading:

• Huntress — Nightmare-Eclipse tooling in a real intrusion

• BleepingComputer — BlueHammer exploited pre-patch

• Barracuda — six zero-days, six weeks, one grudge

• The Register — disgruntled researcher profile

• SecurityWeek — YellowKey + GreenPlasma drop