Loading story…
Researcher MSNightmare (also known as Nightmare-Eclipse) released BigDiskBuster, an experimental proof of concept designed to prevent Microsoft Defender Antivirus from completing platform and security-intelligence updates. The technique monitors Defender update directories, consumes available disk capacity with hidden temporary files, and locks MRT.exe using restrictive file-sharing permissions, potentially interrupting update staging, installation, or rollback and leaving Defender enabled but increasingly reliant on outdated detection content.
The claimed impact across supported Windows versions has not been independently verified, and the released code is reportedly buggy. Security teams should investigate unexplained free-space depletion, hidden files in user Temp directories, persistent handles on MRT.exe, and repeated Defender update failures; 0x80070643 alone is a generic error and does not prove exploitation. Suspected hosts should be validated with preserved telemetry, malicious processes terminated, disk capacity restored, and Defender updated from a trusted source.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Security researcher MSNightmare (Nightmare-Eclipse) released BigDiskBuster, an experimental proof of concept designed to disrupt Microsoft Defender Antivirus platform and security-intelligence updates by exhausting disk space and locking MRT.exe. The researcher supplied a test screenshot showing a Defender update failure, though the technique's effectiveness and cross-version compatibility were not independently verified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Check Point Research disclosed that Microsoft Defender’s Boot-Time Removal driver, **`BTR.sys`**, can be repurposed as a Microsoft-signed kernel primitive for arbitrary file and registry operations, allowing attackers with administrator rights and **`SeLoadDriverPrivilege`** to tamper with protected security components during early startup. The researchers reverse engineered the driver’s undocumented transaction protocol, including its **RC4-encrypted** format and **`:changelist`** alternate data stream, and released the **`BTR_CLI`** proof-of-concept to generate valid transactions and stage the driver across Windows 7 through Windows 11 25H2. The technique does not rely on a memory-corruption flaw or traditional bring-your-own-vulnerable-driver abuse, but instead uses a trusted built-in Windows component that is not covered by Microsoft’s vulnerable driver block rules or common LOLDrivers-style blocking approaches. Researchers said the boot-time execution window could let attackers delete or move files such as **`WdFilter.sys`** and **`MsMpEng.exe`**, or modify service-related registry keys before higher-level protections fully initialize; they reported no observed in-the-wild exploitation and recommended focusing on behavioral detection, monitoring **ADS `:changelist` creation**, unusual **`BTR.sys`** loads, suspicious service staging, **`BootClean.log`** artifacts, and tighter control of **`SeLoadDriverPrivilege`**.
Aug 26, 2026
Microsoft’s fix for the Windows Defender zero-day **RoguePlanet** (`CVE-2026-50656`) is facing new scrutiny after researcher **Chaotic Eclipse** alleged that changes in `mpengine.dll` introduced fresh problems in the Microsoft Malware Protection Engine. The original flaw was described as a race-condition privilege-escalation bug that could yield a **SYSTEM** shell and had public proof-of-concept code, adding to mounting pressure on defenders as Microsoft disclosed more than 200 CVEs in a single month across Windows, Office, SharePoint Server, Visual Studio, and .NET. According to the researcher, the patched engine may expose an eight-byte information disclosure and a more practical denial-of-service condition that can fill local storage by abusing oversized `Zone.Identifier` alternate data streams during Defender scanning over SMB. In the reported scenario, **MsMpEng.exe** continues caching content from a controlled SMB server while a later read request is stalled, eventually exhausting disk space; the behavior was reportedly reproduced on **Windows 11 25H2** and **Windows Server 2025**. Microsoft previously addressed RoguePlanet in engine version `1.1.26060.3008`, but had not publicly confirmed the alleged post-patch issues at the time of reporting.
Jul 10, 2026
NightmareEclipse released **ShieldBreak**, a proof-of-concept local privilege-escalation exploit claimed to bypass Microsoft’s fix for **CVE-2026-50656** (RoguePlanet). The exploit allegedly abuses improper link resolution during Windows Defender remediation, combining Cloud Files placeholders, Object Manager symbolic-link swaps, CLFS path handling, an EICAR-triggered scan, and NTFS alternate data streams to redirect a Defender process running as `SYSTEM` and plant `C:\Windows\System32\phoneinfo.dll`. A fabricated Windows Error Reporting report and the `QueueReporting` scheduled task then cause `wermgr.exe` to load the malicious DLL; the included `Warden.dll` payload reportedly duplicates a SYSTEM token and opens a SYSTEM shell in the unprivileged user’s session. Splunk published attack data and multiple disabled-by-default analytics for the ShieldBreak chain, covering Defender activity on `\globalroot\` object-manager paths (Defender Operational events 1116/1117), `MpClient.dll` loaded by non-Defender processes, ADS creation through loopback administrative SMB shares (Security event 5145), manually created `.wer` files in the Windows Error Reporting ReportQueue, creation of phantom DLLs such as `phoneinfo.dll` in system paths, and `WerMgr.exe` spawning SYSTEM-integrity children. Organizations should collect the required Sysmon, Security, and Defender Operational telemetry; enable file-share object-access auditing; investigate these signals promptly; and validate the creating process, signer, file hash, and operational need before suppressing alerts.
Aug 28, 2026