GitHub Bans Did Not Stop Nightmare Eclipse’s ShieldCrash

Nightmare Eclipse said on September 9 that ShieldCrash can dump the Windows SAM database as a full privilege escalation.

The researcher had published the proof of concept on GitHub the day before, hours after Microsoft’s September 2026 Patch Tuesday, and wrote that it still works on fully patched Windows. GitHub had already banned the first Nightmare Eclipse account in May, and GitLab followed within days. The code is back anyway, this time under the MSNightmare account, as a bypass of the Defender engine fix Microsoft shipped for ShieldBreak.

ShieldCrash Lands Hours After September’s Patches

The drop is the latest in a campaign that began in April, when the researcher, also seen as Chaotic Eclipse and Dead Eclipse, started publishing weaponized Windows bugs with working code. The May scare was a July 14 date and a threat to shatter Microsoft. What arrived instead is a standing Patch Tuesday habit: Microsoft ships a Defender fix, and a bypass of that fix shows up on GitHub the same day or shortly after.

On September 8 the MSNightmare account posted that Microsoft had failed to patch ShieldBreak, tracked as CVE-2026-69414, and that ShieldCrash was a full bypass that works with the latest September patch. The README on that repository is blunter about the published build. It calls the code a skeleton proof of concept that shows an arbitrary file read as SYSTEM, and says a fuller exploit may come later.

I might rework this later into a full SYSTEM PoC but for now I’m dropping this skeleton PoC because I’m feeling a bit lazy.

Nightmare Eclipse, ShieldCrash README, GitHub

That lazy note is the opposite of the July 14 line that made the first round of headlines. A follow-up on September 9 walked the claim back up. The researcher wrote that ShieldCrash is a full privilege escalation, not only a file read, that the SAM database is easy to drop, and that anyone who wants a finished exploit should look at the BlueHammer code.

Microsoft did not issue an advisory for ShieldCrash in the hours after the GitHub post.

https://x.com/MSNightmare2000/status/2097402129723932719

The GitHub Ban That Did Not Stick

The platform fight is the part of this story that was supposed to be over. GitHub removed the Nightmare Eclipse account around May 23, 2026, after Microsoft was accused of flagging the repositories. GitLab suspended the mirror on May 26 and 27 for hosting weaponized zero-day exploit code. With both large code hosts closed, the researcher moved to a personal blog and signed posts with PGP so readers could tell the files were genuine.

That sequence was meant to cut distribution. It cut the original account names. It did not cut the cadence, and it did not keep the later bypasses off GitHub. ShieldCrash, ShieldBreak, and a CrowdStrike Falcon proof of concept called FalconFlank all landed on the MSNightmare GitHub account. Windows admins who patch on Microsoft’s calendar are now chasing the same researcher on a platform Microsoft owns.

FROM THE FIRST DROP TO SHIELDCRASH

1. April 2, 2026: Publishes BlueHammer, a Defender local privilege escalation later tracked as CVE-2026-33825.
2. April 10, 2026: Huntress sees a BlueHammer build named FunnyApp.exe during a live intrusion.
3. April 14, 2026: Microsoft patches BlueHammer in the April Patch Tuesday release.
4. May 21, 2026: Ships out-of-band Defender fixes for RedSun (CVE-2026-41091) and UnDefend (CVE-2026-45498).
5. May 23 to May 27, 2026: GitHub removes the original account; GitLab suspends the mirror; MSRC publishes its coordinated disclosure post.
6. June 2026 Patch Tuesday: Patches YellowKey, GreenPlasma, and MiniPlasma; RoguePlanet drops the same day.
7. July 14, 2026: Publishes LegacyHive, the date that had been marked for a larger hit.
8. September 8, 2026: Publishes ShieldCrash on GitHub after Microsoft’s September patches.

The first wave of earlier unpatched Windows zero-days did get June fixes. The account bans still failed at the job they were hired to do, which was to stop the next public binary from circulating on a well known host.

What the New Defender Bypass Can Do

ShieldCrash is not a new product bug in the usual sense. It is a claimed bypass of ShieldBreak, which was itself a claimed bypass of RoguePlanet, a Defender race Microsoft patched in July as CVE-2026-50656. Microsoft assigned ShieldBreak CVE-2026-69414 on August 14, rated it Important at CVSS 7.8, and classed it as CWE-284 improper access control in the Microsoft Malware Protection Engine. The advisory, last updated September 3, says the last affected engine is 1.26070.7 and the first fixed build is Defender engine version 1.1.26080.3.

Microsoft says that engine update does not need a manual install when automatic updating is on, that systems with Defender turned off are not in an exploitable state even if old binaries remain on disk, and that exploitation of ShieldBreak was more likely even though it had not been seen in the wild at publication. The researcher credit on that advisory is Anonymous. The ShieldCrash README says Microsoft closed several ShieldBreak paths and missed a spot where the same problem can still be triggered, on all supported Windows versions, with the September 2026 patches applied.

WHAT WE KNOW

• Published code: ShieldCrash.cpp, a Warden.dll, and an EICAR test zip are on the public MSNightmare GitHub repository.
• Researcher claim: The September 8 README shows a SYSTEM file read; the September 9 post says the same issue is a full elevation that can drop SAM.
• Prior fix: Microsoft’s ShieldBreak advisory lists engine 1.1.26080.3 as the first build that addresses CVE-2026-69414.

WHAT IS UNCONFIRMED

• Vendor advisory: Microsoft had not published a ShieldCrash CVE or engine revision in the hours after the drop.
• In-the-wild use: No public incident report has tied ShieldCrash itself to a live intrusion.
• Finished shell: The published skeleton still does not ship a ready SYSTEM command prompt, even after the SAM hint.

A local Defender bug is not an initial-access worm. It becomes useful after someone already has a foothold, which is why the April Huntress case still matters: the first tools from this campaign were tried in a real network as soon as they were public.

July 14 Produced a Stripped Hive Exploit

The line that framed the May coverage was aimed at Microsoft and at July 14, which was also Patch Tuesday.

Mark this date, July 14th. I will make sure your bones are shattered that day.

Nightmare Eclipse, signed blog post, May 2026

Before that date arrived, the researcher already scaled the promise down. A June blog update said the larger hit needed more work, and that the July drop would be the least interesting and least impactful bug they had shipped since the campaign started. LegacyHive matched that self-review. It is a User Profile Service flaw that lets a standard user mount another user’s registry hive, including an administrator’s, and it was released with a stripped proof of concept so copy-paste use would be harder.

Independent testers still took it seriously. Kevin Beaumont said the exploit worked and was unpatched when it landed. Will Dormann called the hive-redirection primitive pretty powerful, because a low-privilege user could change the classes hive of an admin account. Microsoft later tracked the bug as CVE-2026-50661 and shipped a fix. The date that was supposed to shatter Microsoft produced a useful local trick and another Patch Tuesday headline, then the campaign moved on.

Huntress Watched the First Tools Fail on a Live Box

The reason defenders still read these drops is not the tone of the blog posts. Huntress documented a live intrusion using public Defender tools in April, inside a broader break-in that started with stolen FortiGate SSL VPN access, including a source address geolocated to Russia.

WHAT HUNTRESS SAW IN APRIL

• FunnyApp.exe: A BlueHammer build ran from a user’s Pictures folder on April 10 and was quarantined as Exploit:Win32/DfndrPEBluHmr.
• Matching names: RedSun.exe, undef.exe, and a renamed z.exe sat in user-writable folders, including short subfolders under Downloads.
• Hands on keyboard: The operator ran whoami /priv, cmdkey /list, and net group, then tried a Go tunneling agent Huntress nicknamed BeigeBurrow.
• The result: None of the Nightmare Eclipse tools succeeded in that incident, and the operator mishandled UnDefend.

Failure on one box is not the same as a clean bill of health. CISA added the first Defender trio to its Known Exploited Vulnerabilities catalog and gave federal agencies until June 3 to patch CVE-2026-41091 and CVE-2026-45498. Microsoft’s own May post named RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma as uncoordinated public releases that put customers at risk. Barracuda later described a chain that pairs a SYSTEM elevation with UnDefend’s attack on Defender updates, which is the practical use of these bugs even when a single operator fumbles the run.

BlueHammer is the specimen that shows why a Defender bug is worth more than a crash. Huntress walked the public code and found a race in which Defender, paused against a Volume Shadow Copy, is tricked into reading the SAM password database while believing it is importing a definition file. A local account that can make Defender do that job does not need a new remote hole. It needs a foothold, which stolen VPN credentials already supply.

Microsoft Invoked Its Digital Crimes Unit

MSRC published its response on May 27, without naming the researcher, and argued that the six named bugs had not gone through Coordinated Vulnerability Disclosure. The post said the details were not shared before release and that the disclosures put customers at unnecessary risk. It also pointed at law enforcement.

Uncoordinated disclosures that put proof-of-concept code for unpatched vulnerabilities into the hands of bad actors are never justifiable and have real-world consequences. Our Digital Crimes Unit will continue bringing cases against these actors and those that enable their criminal activity.

MSRC Team, Microsoft Security Response Center, May 27, 2026

The same post said Microsoft’s Digital Crimes Unit coordinating with law enforcement would keep bringing those cases. Katie Moussouris, founder of Luta Security and an early architect of Microsoft’s bug bounty work, called the return to “responsible” disclosure a first strike and said a prosecution threat via the Digital Crimes Unit was over the top and would make researchers distrust Microsoft. After that backlash, Microsoft said it would not take legal action against the researcher.

The researcher has said the public drops followed a broken arrangement, a deleted MSRC account, and unpaid or uncredited reports. Microsoft’s May post said none of the six named bugs arrived through official channels before they were public. Both things can be on the record at once. The ShieldBreak advisory later credited Anonymous, which is how the company now files the same campaign: patch the engine, skip the name, watch the next bypass land on GitHub.

A Third Hole in the Same Engine

The original six are no longer the open set they were in May. YellowKey, a WinRE BitLocker bypass Microsoft patched in June as CVE-2026-45585, joined a longer run of BitLocker bypasses that keep arriving on Windows 11. GreenPlasma (CVE-2026-45586) and MiniPlasma (CVE-2020-17103, a Cloud Filter driver issue Google Project Zero’s James Forshaw reported in 2020) also landed in that June batch. MiniPlasma was ugly because Will Dormann confirmed the old proof of concept still worked on Windows 11 with the May 2026 updates installed.

What is still open is the Defender nest. RoguePlanet became ShieldBreak. ShieldBreak became ShieldCrash. Each Microsoft engine fix is the starting point for the next public file.

THE NIGHTMARE ECLIPSE WINDOWS DROPS

The monthly rhythm is now the operational problem. Admins who applied the September patches, and who take Defender engine updates automatically, still have a public claim that a sibling path in the same engine can read files as SYSTEM and dump SAM. The researcher has also started publishing against other vendors, including a Falcon proof of concept that Kevin Beaumont confirmed works, which means the Patch Tuesday appointment is no longer only Microsoft’s.

The ShieldCrash files remain on the public GitHub repository. Microsoft had not issued an advisory for the new bypass in the hours after the drop, and the researcher invited anyone else to finish a full exploit from the BlueHammer code before they did.