A single researcher has dropped six Windows zero-days in six weeks. Three now power real attacks. And the feud shows no sign of cooling.
Nightmare-Eclipse, who also posts as Chaotic Eclipse and Dead Eclipse, released proof-of-concept code for flaws touching Windows Defender, BitLocker, and core system components. The first exploit, BlueHammer, hit GitHub on April 3, 2026. Others followed quickly. Attackers wasted little time. BlueHammer, RedSun, and UnDefend entered active exploitation soon after publication, according to Barracuda Networks and Huntress Labs reporting. CISA added some to its Known Exploited Vulnerabilities catalog. Patching windows shrank from days to hours.
Microsoft pushed back this week. In a blog post the company stressed that none of the six bugs — RedSun (CVE-2026-41091), UnDefend (CVE-2026-45498), BlueHammer (CVE-2026-33825), YellowKey (CVE-2026-45585), GreenPlasma, and MiniPlasma — reached its official channels before public release. “Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable and have real-world consequences,” the statement read. It went further. Redmond’s Digital Crimes Unit would pursue those enabling criminal activity and coordinate with law enforcement worldwide.
The researcher fired back with PGP-signed posts. Microsoft deleted the account used for bug reports. Communication stopped. Public advisories defamed the finder despite zero compensation or credit. “When I actively asked you to communicate with me, you refused, humiliated me and made sure to insult me in front of people,” one message stated. Another carried a stark warning. “Mark this date July 14th, I will make sure your bones are shattered that day.”
Platforms acted too. GitHub, owned by Microsoft, removed the researcher’s repositories around May 23. GitLab followed days later. The bans only fueled fresh accusations of suppression. The researcher claimed Microsoft still held leverage that blocked certain document releases in June. Yet the July 14 deadline stood firm. And a “dead man’s switch” supposedly stood ready to release more code if needed.
BlueHammer abused Windows Defender’s signature update process and Volume Shadow Copy Service. It turned a standard user into NT AUTHORITY\SYSTEM. RedSun took a different path through Defender but reached the same SYSTEM privileges. UnDefend degraded the antivirus, making systems appear healthy while blinding detection. YellowKey targeted BitLocker configurations relying on TPM-only protection, potentially exposing data on physically accessed devices. GreenPlasma and MiniPlasma expanded into broader local privilege escalation. MiniPlasma stood out. It revived a flaw supposedly fixed in 2020 yet still worked on fully patched Windows 11 systems in May 2026, per independent tests noted in ThreatLocker analysis.
But the technical details matter less than the pattern. Each release came timed after Patch Tuesday. Each carried a memorable color-plus-noun name that mocked Microsoft branding. Blue for the company’s signature color. Hammer for blunt force against its own tools. The naming alone signaled intent. This was personal.
The researcher described a broken agreement. Microsoft had “left me homeless with nothing.” Earlier posts alleged direct threats from MSRC staff that they would ruin the reporter’s life. Whether the individual once worked inside Microsoft remains unconfirmed. The depth of knowledge suggests either insider history or exceptional skill. Either way the grudge runs deep.
Platforms didn’t want the liability. Hosting weaponized zero-day code crosses lines for most code repositories. Yet the removals fed the narrative of corporate retaliation. The researcher moved statements to a Blogspot site. New accounts appeared. The flow of information continued.
Microsoft’s response drew sharp criticism from veterans of the disclosure process. Dustin Childs, bug hunter-in-chief at the Zero Day Initiative and a former Microsoft security employee, called the company’s public stance bold. “CVD is a two-way street,” he told The Register. “The vendor has some responsibility as well, so to go out publicly stating this person violated CVD without showing any of the correspondence seems bold.” He noted missing clear guidance to customers on real risks and defenses.
Katie Moussouris, who built Microsoft’s original bug bounty program, saw mixed messages. The company claimed its processes ensure compensation and acknowledgment. Yet the researcher reported receiving neither. “The language choices are also not deescalating,” she said in the same Register report. Invoking outdated “responsible disclosure” language felt subjective and judgy. Mention of the Digital Crimes Unit in a vulnerability post carried a vaguely threatening tone. And the power imbalance was obvious. “The bugs are Microsoft’s. They wrote the code and they own the risk to customers.”
Kevin Beaumont, another ex-Microsoft hand, labeled the situation a “dumpster fire of [Microsoft’s] own making.” He pointed to past decisions, including hiring a researcher who had previously published zero-days. Criminalizing deviations from disclosure rules would prove difficult to defend given that history.
Enterprise defenders felt the pain immediately. Muhammad Qasim Shahzad, a systems engineer, observed on LinkedIn that one person caused more enterprise-level damage in six weeks than most APT groups manage in a year. The gap between disclosure and weaponization had collapsed. Russian-geolocated infrastructure appeared in some follow-on intrusions, per Barracuda tracking, though no direct tie to the researcher exists.
This episode exposes long-standing friction in coordinated vulnerability disclosure. Researchers have complained for years that Microsoft proves difficult, especially on moderate-severity bugs. Some stopped reporting to Redmond altogether. AI-assisted discovery will only increase volume and speed. Poor interactions risk real customer harm. Childs urged the industry to remember real people stand on both sides.
YellowKey still lacks a patch. Microsoft noted exploitation more likely because a working proof-of-concept exists. GreenPlasma and MiniPlasma remain open too. BlueHammer received an April patch under CVE-2026-33825, yet the others lag. Organizations race to deploy updates, harden BitLocker with PINs and firmware passwords, layer network and identity controls outside the endpoint, and monitor for post-exploitation behavior. Defender version 4.18.26050.3011 or newer helps against some vectors.
The July 14 date looms. The researcher holds back at least one major release and hints at remote code execution bugs ahead. Threats to involve other companies add uncertainty. Microsoft continues investigating. Its public tone shows no softening. The Digital Crimes Unit reference suggests lawyers and investigators stay engaged.
Whatever the personal backstory, the outcome lands on Windows users and administrators. They patch faster. They assume shorter windows. They watch for the next drop. One researcher’s grudge has rewritten the timeline for Windows security response. And the calendar now counts down to mid-July.
WebProNews is an iEntry Publication