Six working exploits in six weeks. Three already active in attacks. The other three confirmed effective against fully patched Windows 11. And the actor behind all of it is threatening to escalate to remote code execution by June Patch Tuesday.
Nightmare-Eclipse is assessed as a single individual, not a state actor, not a criminal group. A researcher with a grievance against Microsoft’s vulnerability handling who has decided that publishing functional exploit code is the appropriate response. The intent is documented. The delivery has been consistent. The results are now showing up in Huntress SOC telemetry as active exploitation linked to Russian-geolocated infrastructure.
What the six exploits actually do
The toolkit covers two attack surfaces, and they work together.
Defender abuse: BlueHammer and RedSun exploit vulnerabilities in the Microsoft Malware Protection Engine, turning the privileged kernel access that Defender requires to do its job against the user it’s meant to protect. UnDefend is subtler: it progressively corrupts Defender’s scan engine state, degrading detection accuracy over time rather than triggering a clean kill switch. The effect is a reliable window in which secondary payloads can operate without tripping alerts. If you’re relying on Defender as your primary detection layer, those three exploits together represent a credible way to blind it.
Privilege escalation: YellowKey targets Windows BitLocker’s recovery environment. GreenPlasma abuses a kernel-level flaw for SYSTEM access from standard user sessions. MiniPlasma, published to GitHub on 13 May, exploits a vulnerability the actor claims Microsoft patched and then silently reversed. Independent researchers have confirmed the PoC produces SYSTEM access on current Windows 11 builds. Not a theoretical finding.
Who’s actually exploiting these
The active exploitation via Huntress telemetry is linked to Russian-geolocated hosting infrastructure. That’s almost certainly criminal actors (ransomware affiliates or initial access brokers) who have folded publicly available exploit code into their existing tooling. Not Russian state direction. The geography is commonplace for Eastern European cybercriminal infrastructure; the implication is criminal opportunism, not Kremlin coordination.
Nightmare-Eclipse made this straightforward. Publishing functional exploit code publicly hands the toolkit to anyone motivated to use it. Deliberate choice, as the actor has been explicit about. The downstream exploitation is the expected consequence, not a surprise.
The June Patch Tuesday problem
Posts on the actor’s blog and GitHub contain explicit threats to release RCE exploits next, with a specific reference to “a big surprise” for June 2026 Patch Tuesday. If that materialises, organisations are looking at a period of unpatched pre-authentication remote code execution exposure on Windows endpoints. That’s qualitatively worse than the current privilege escalation risk. Much worse.
There’s no guarantee it happens. The actor has made claims before. But the track record here is a new exploit drop roughly every ten days over the past six weeks. Dismissing the June threat requires more confidence in Microsoft’s ability to identify and patch it in time than the recent cadence justifies.
What to do this week
Update Defender. All May patches applied, including any out-of-band updates for CVE-2026-41091. Verify this across the estate, not just on the machines you think about.
Check EDR telemetry for BlueHammer, RedSun, and UnDefend indicators. Huntress and several other providers have published detection logic: use it.
Enable Defender Tamper Protection on all endpoints. That’s the primary mitigation against UnDefend-style degradation.
Before June Patch Tuesday
Stop treating Defender as your only endpoint detection layer. Add a behavioural EDR with an independent scanning engine if you don’t already have one. The Defender abuse exploits specifically target the engine you’d be depending on to catch the others.
Restrict standard user accounts from executing unsigned binaries in user-writable paths. That limits the privilege escalation surface, though it won’t eliminate it.
Follow Nightmare-Eclipse’s GitHub directly. The actor has consistently published code publicly before attacks begin. That gap is short, but it’s a real warning window that most organisations are currently not watching.
The underlying problem here matters beyond this specific campaign. One motivated person generating confirmed, functional zero-days faster than Microsoft can patch them is a structural issue with no clean resolution in the near term. Expect June Patch Tuesday to be a difficult one.