The ongoing war of attrition between Microsoft's Security Response Center and the security researcher known as Nightmare Eclipse reached a fever pitch in mid-June 2026, as part of a disclosure campaign the researcher began in April.
The Unrelenting Zero-Day Campaign
The researcher operating under the pseudonyms Nightmare Eclipse, Chaotic Eclipse, and the GitHub handle MSNightmare claims to be a former Microsoft employee and has accused the company of ignoring vulnerability reports and removing their bug-bounty submission accounts - a characterization Microsoft has not confirmed. Whatever the motive, the effect has been a sustained campaign: RoguePlanet was the researcher's seventh publicly released zero-day since April 2026, following BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, and MiniPlasma - several of which targeted Microsoft Defender and BitLocker directly. Operating across GitHub and self-hosted mirrors like git.projectnightcrawler.dev, the researcher has continued releasing unpatched vulnerabilities even after Microsoft ships fixes, repeatedly weaponizing Defender's own remediation loops and the Windows Recovery Environment (WinRE) against the system they protect.
The Project Nightcrawler & MSNightmare Timeline
Mid-May 2026 The Catalyst Update
Microsoft rolled out mitigations that closed off a remote code execution (RCE) attack path that Nightmare Eclipse had been exploiting, which involved tricking victims into opening .vhd(x) files on remote SMB servers. This forced the researcher into a manual rewrite, pivoting the exploit codebase toward local privilege escalation (LPE).
June 10, 2026 The RoguePlanet Release
Hours after Microsoft shipped Patch Tuesday updates fixing the researcher's older GreenPlasma and YellowKey vulnerabilities ( CVE-2026-45586 and CVE-2026-50507), Nightmare Eclipse published RoguePlanet on GitHub, a zero-day exploiting a race condition in Microsoft Defender to escalate to SYSTEM. The researcher was candid about its reliability, describing it as "a hit or miss" that reached a 100% success rate on some machines while struggling on others - still enough for security researchers to validate it against fully updated Windows 11 and Windows 10 machines.
June 11, 2026 The GreatXML Drop
One day after RoguePlanet, Nightmare Eclipse dropped another zero-day codenamed GreatXML under the MSNightmare handle. GreatXML is a post-compromise persistence tool, not an initial-access exploit: it requires an attacker who already has administrator rights and a machine on which a Defender Offline Scan was run at some prior point. Under those conditions, it turns WinRE into a BitLocker backdoor.
June 16 – June 18, 2026 Industry Validation and Tracking
By June 16, Microsoft officially confirmed CVE-2026-50656 for RoguePlanet with a CVSS score of 7.8, and said a fix was in development without giving a timeline. Nightmare Eclipse provided documentation that RoguePlanet functions identically regardless of whether Defender's real-time protection is toggled on or off. Concurrently, the Cyderes Howler Cell team published a technical analysis verifying the GreatXML exploit chain on a fully patched Windows 11 machine.
Key Metrics and Attack Surfaces
- The RoguePlanet Exploit: Tracked as CVE-2026-50656, this CVSS 7.8 race condition (CWE-362) targets the Microsoft Malware Protection Engine, allowing a local attacker to obtain a command shell with SYSTEM privileges - reliability varies by machine.
- Defender Independence: The RoguePlanet proof-of-concept works regardless of whether Defender's real-time protection is enabled or disabled, rendering simple toggling ineffective as a mitigation strategy.
- The GreatXML Bypass: Requires an attacker who already has administrator rights on a machine where Defender's Offline Scan has run at least once; from that state, it abuses the WinRE/unattend.xml interaction to grant unrestricted shell access to BitLocker-encrypted volumes without a decryption key.
Deep Technical Teardown of the Exploits
Rather than bypassing endpoint security, Nightmare Eclipse's exploits weaponize the very tools designed to protect the system. RoguePlanet ( CVE-2026-50656) exploits a race condition within the Microsoft Malware Protection Engine. The attack begins when a low-privileged user executes a binary that creates a temporary workspace and stages a malicious payload disguised as `wermgr.exe`, attaching an NTFS alternate data stream to it. The payload writes an EICAR-like file to trigger an on-access scan by `MsMpEng.exe`. To win the race condition during the scan, RoguePlanet utilizes opportunistic oplocks, directory junctions, and volume shadow copy paths. By executing a lightning-fast junction swap while Defender is actively scanning, the exploit redirects Defender into overwriting the legitimate, highly privileged system executable (`C:\Windows\System32\wermgr.exe`) with the malicious payload. Once executed, this grants an immediate command shell with full SYSTEM privileges.
Conversely, GreatXML serves as a persistent post-compromise mechanism that completely disables BitLocker disk protection - and, as noted above, it requires an attacker who already has administrator access; it is not a way in on its own. It exploits a design-level interaction between the Windows Recovery Environment (WinRE), Windows answer file automation, and the state left behind by a Microsoft Defender Offline Scan. An attacker with administrator rights can plant a specifically engineered `unattend.xml` configuration file and a modified `Recovery` folder structure directly onto the root of the recovery partition. The next time the system boots into WinRE-which can be triggered from the lock screen via `Shift + Restart`-the environment processes the planted XML file without verifying its digital signature. This action spawns an unrestricted command prompt shell, granting direct access to read or modify files on the BitLocker-encrypted drives, bypassing the need for a recovery key.
Authoritative References and Threat Intelligence
RoguePlanet Analysis: Morphisec Blog on CVE-2026-50656
GreatXML Verification: Cyderes Howler Cell Enterprise Defenses
Timeline & Exploits overview: SecurityWeek Archives
Patch & Ongoing Campaign: The Register - Microsoft closes book on RoguePlanet (July 9, 2026)