# BigDiskBuster PoC Blocks Microsoft Defender Antivirus Updates via Disk-Space Exhaustion

> Former Microsoft Security Response Center researcher Abdelhamid Naceri (NightmareEclipse / Chaotic Eclipse / MSNightmare) publicly released BigDiskBuster, a C++ proof-of-concept that watches Microsoft Defender Antivirus's update staging paths and fills all remaining free disk space with hidden delete-on-close files the moment a platform or security-intelligence update begins, forcing the update to fail and leaving Defender on stale threat definitions. No CVE has been assigned and no Microsoft advisory exists as of publication.

- **Published:** 2026-09-22T00:00:00Z
- **Last reviewed:** 2026-10-06T19:15:50.943Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2618
- **ID:** TL-2026-2618
- **Severity:** MEDIUM
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** NightmareEclipse
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

BigDiskBuster is a Windows Defender Antivirus denial-of-service proof-of-concept published to GitHub (github.com/MSNightmare/BigDiskBuster, MIT-licensed, implemented in a single C++ source file 'BigDiskBuster.cpp', 3 commits, 168 stars, 27 forks, 1 open issue) on or around September 19, 2026 by Abdelhamid Naceri, a former Microsoft Security Response Center researcher who worked for Microsoft's UK and Germany operations before being terminated in 2024. Naceri says the dismissal came 'abruptly and without providing a clear justification'; he rejected multiple financial settlement offers and challenged the termination in German labor court, alleging Microsoft presented 'shifting arguments throughout the proceedings.' The court upheld the termination, leaving him with minimal compensation after a costly legal battle he says damaged his mental health severely enough to require psychiatric hospital treatment. He publicly revealed his real identity around September 12, 2026, roughly a week before releasing BigDiskBuster, and in the same disclosure admitted fabricating earlier claims that Microsoft had sued him.

The tool's author describes it as 'similar to UnDefend' (his own earlier Defender DoS PoC, patched by Microsoft as CVE-2026-45498 in the out-of-band Antimalware Platform 4.18.26040.7 update on May 21, 2026, alongside the related CVE-2026-41091 — a separate local-privilege-escalation flaw in the Microsoft Malware Protection Engine caused by improperly resolving links before accessing files, fixed in engine version 1.1.26040.8. Both CVEs were confirmed exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, with a federal civilian-agency remediation deadline of June 3, 2026, alongside Naceri's earlier BlueHammer (CVE-2026-33825, CVSS 7.8) and RedSun.

BigDiskBuster monitors the C:\ volume for new directories appearing under Defender's platform- and definition-update staging paths. The instant an update begins, it checks available disk capacity and creates a hidden, delete-on-close temporary file in the user's Temp directory sized to consume all remaining free space; if capacity is freed mid-update, additional worker threads race to reclaim it, repeatedly starving the installer until it fails with the generic Windows Security installation error 0x80070643 (the researcher and reporting both note this error code has multiple unrelated possible causes and should be corroborated with other telemetry before being attributed to the tool). Once Defender tears down its staging directory following the failed attempt, BigDiskBuster deletes its own hidden file to free the disk again and waits for the next update attempt, repeating indefinitely. Independently of the disk-exhaustion loop, the tool also opens a handle on MRT.exe (the Windows Malicious Software Removal Tool) with restrictive sharing permissions, denying other processes write or delete access while the handle is held open, which blocks Windows Update from replacing that binary. The author characterizes the current release as 'a bit buggy and needs some rewritting' and claims — without independent verification — that it works on all currently supported Windows versions. As of publication there is no confirmed in-the-wild deployment of BigDiskBuster itself and no independent researcher has confirmed the claimed behavior, though the researcher's prior Defender tools (BlueHammer, RedSun, UnDefend) were each confirmed exploited by other threat actors after release, establishing a pattern in which his uncoordinated PoCs are weaponized within weeks.

Naceri's broader 2026 release cadence — nearly a dozen uncoordinated zero-days since April — extends beyond Microsoft: reporting also attributes to him GreenSection (an Nvidia driver memory-corruption flaw), HardBreacher (a Kaspersky Endpoint Security privilege-escalation flaw), PrettyPrague (an Avast Antivirus privilege-escalation flaw), and FalconFlank (a CrowdStrike Falcon privilege-escalation flaw), indicating the pattern of vendor-uncoordinated security-product disclosures is not limited to Microsoft. His earlier BlueHammer and RedSun tools both abused Windows Defender's privileged remediation/cloud-rollback file operations via opportunistic locks (oplocks) combined with NTFS junctions redirecting a temp-directory target path to C:\Windows\System32, letting an attacker overwrite a system binary with SYSTEM privileges via a time-of-check-to-time-of-use race condition — a materially different, code-execution-capable class of bug from BigDiskBuster's pure denial-of-service mechanism, but from the same author and disclosure pattern.

Security reporting recommends defenders verify Defender's current platform/signature versions (Get-MpComputerStatus, checking the AMEngineVersion and AMProductVersion fields), watch for repeated Defender update failures, sustained free-space collapse, unusual hidden files under user Temp directories, persistent open handles on MRT.exe, and a gap in Windows Defender Operational log Event ID 2000 (which normally records successful signature updates), and force updates through Windows Update, WSUS, the Windows Security app, or MpCmdRun.exe if native update paths appear to be interfered with. Recommended response steps include preserving process and file-handle telemetry, terminating suspicious processes, recovering consumed disk space, and validating whether error 0x80070643 instances correlate with a genuine attack versus an unrelated installer fault. WDAC/AppLocker can restrict execution of unrecognized binaries that would otherwise run a tool like this.

## MITRE ATT&CK

- T1587.001 Malware
- T1608.001 Upload Malware
- T1204.002 Malicious File
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1685 Disable or Modify Tools
- T1564.001 Hidden Files and Directories
- T1070.004 File Deletion
- T1499 Endpoint Denial of Service

## Sources

- [NightmareEclipse's latest zero-day leaves Microsoft Defender stuck in the past](https://www.theregister.com/security/2026/09/22/nightmareeclipses-latest-zero-day-leaves-microsoft-defender-stuck-in-the-past/5298320)
- [Researcher Drops BigDiskBuster Zero-Day PoC That Blocks Microsoft Defender Updates](https://thehackernews.com/2026/09/researcher-drops-bigdiskbuster-zero-day.html)
- [Nightmare Eclipse Drops New Microsoft Defender Exploit After Revealing Identity](https://www.securityweek.com/nightmare-eclipse-drops-new-microsoft-defender-exploit-after-revealing-identity/)
- [Chaotic Eclipse Released BigDiskBuster, A PoC For Windows Defender Update DoS Zero-Day](https://securityaffairs.com/199538/hacking/chaotic-eclipse-released-bigdiskbuster-a-poc-for-windows-defender-update-dos-zero-day.html)
- [MSNightmare Releases New PoC for DoS Vulnerability in Windows Defender](https://cybersecuritynews.com/defender-bigdiskbuster-dos-flaw/)
- [MSNightmare/BigDiskBuster (GitHub repository / PoC source)](https://github.com/MSNightmare/BigDiskBuster)
- [Microsoft Defender vulnerabilities exploited in the wild (CVE-2026-41091, CVE-2026-45498)](https://www.helpnetsecurity.com/2026/05/21/microsoft-defender-vulnerabilities-cve-2026-41091-cve-2026-45498/)
- [BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Vulnerability Explained](https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2618