NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past
NightmareEclipse released BigDiskBuster, a PoC that blocks Microsoft Defender platform and signature updates by exhausting disk space.
Researcher Abdelhamid Naceri (NightmareEclipse) published the BigDiskBuster PoC, which leaves Defender running but unable to install platform and security intelligence updates. The tool waits for an update to start, fills the drive with hidden temporary files, and holds a restrictive handle on MRT.exe, releasing space once the update fails (screenshot shows error 0x80070643). The researcher claims it works on all supported Windows versions, which is unverified, and there is no indication of real-world use. It is the latest release in an ongoing public feud with Microsoft over vulnerability disclosure, following RoguePlanet, LegacyHive, ShieldBreak, and ShieldCrash.
- PoC keeps Defender running but stuck on outdated signatures and platform version
- Fills disk with hidden files and locks MRT.exe to break the update process
- Claim of all supported Windows versions affected is unverified; no in-the-wild abuse observed
- Stale definitions could reduce detection of newly identified malware
- Organizations
- MicrosoftNightmareEclipseAbdelhamid Naceri
From the original article
3 min read at theregister.comBigDiskBuster leaves Microsoft's antivirus running but unable to install updates
By Carly Page · theregister.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.