Nightmare-Eclipse: Rogue researcher releases six Windows zero-day exploits since April 2026
By
Barracuda Networks
The bagel they save for the regulars. Don't skim, savour.
Summary
Nightmare-Eclipse is a rogue security researcher who has released six Microsoft Windows zero-day exploits (BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma) since April 2026. The exploits target various Windows components including the Cloud Files Mini Filter Driver, Windows Defender, and other core security features. The researcher's motivations appear to be a grudge against Microsoft, with symbolic naming conventions and imagery (including '666' and 'deadeclipse' in the blog URL). The article profiles the threat actor's identity, motivation, exploit analysis, confirmed in-the-wild exploitation, and provides defensive recommendations for MSPs and IT security teams.
Key quotes
· 3 pulledIt's hard to say whether the 'eclipse' motif has any significance. It could be a metaphor for eclipsing/overtaking Microsoft security or darkening the Microsoft name.
The blog URL includes '666' and 'deadeclipse,' and the name includes 'chaotic.' We don't have to dig deep to find meaning here.
MiniPlasma is the most recent release, and the first name to break the color + noun pattern.
You might also wanna read
Anonymous researcher releases two new Windows zero-day exploits after Patch Tuesday
An anonymous security researcher (Nightmare-Eclipse/Chaotic Eclipse) has released two new Windows zero-day exploits — YellowKey (a BitLocker
theregister.com·3d ago
Security researcher publishes YellowKey zero-day exploit that bypasses Microsoft BitLocker encryption via USB stick
Security researcher Chaotic Eclipse (Nightmare-Eclipse) has published two new zero-day exploits targeting Microsoft systems after their prev
tomshardware.com·18d agoBlueHammer abuses Windows Defender's update process to gain SYSTEM access
Security researcher claims BitLocker bypass vulnerability may be intentional Microsoft backdoor
A security researcher known as Nightmare-Eclipse has discovered and released YellowKey, a vulnerability that allegedly bypasses Microsoft's
techspot.com·14d ago
Windows Defender Vulnerability Allows Malicious File Persistence Through Cloud Tag Detection
The article describes a GitHub repository called 'RedSun' that documents a Windows Defender vulnerability. The vulnerability involves Window
github.com·1mo ago
Analysis: Sophisticated Backdoor Campaign Targets Ivanti EPMM Using Dormant Shells
A February 2026 cybersecurity campaign targeted Ivanti Endpoint Manager Mobile (EPMM) systems with sophisticated backdoor techniques. Instea
defusedcyber.com·3mo ago