A security researcher found six unpatched vulnerabilities in Windows Defender and BitLocker. Microsoft’s response wasn’t a patch schedule — it was a threat of criminal prosecution.

Someone operating under the handle “Nightmare Eclipse” spent April and May publicly dropping proof-of-concept exploit code for vulnerabilities they dubbed BlueHammer, RedSun, UnDefend, and YellowKey, among others. The flaws hit Microsoft Defender and BitLocker — core security infrastructure baked into every Windows installation. At least three of them landed on CISA’s Known Exploited Vulnerabilities catalog. Huntress, a cybersecurity firm, reported seeing exploit tooling related to BlueHammer, RedSun, and UnDefend during real-world intrusion investigations.

These are not theoretical bugs. They are actively being tested in live environments.

Microsoft’s response came via a blog post from the Microsoft Security Response Center. The company accused Nightmare Eclipse of failing to follow “proper coordination” and warned that its Digital Crimes Unit “will continue bringing cases against these actors and those that enable their criminal activity — coordinating as needed with law enforcement around the world.”

The threat landed like a grenade in the security community.

“A Dumpster Fire of Its Own Making”

Kevin Beaumont, a former Microsoft senior security analyst, was among the first to call out the company’s posture. In a blog post on DoublePulsar.com, he described the situation as exactly that.

“Proof of concept exploit creation and distribution for zero days is ‘criminal activity’ now?” Beaumont wrote. “Responsible disclosure quite often is framed to protect the product owner, not the customer — using it to try to criminally prosecute people is a new low.”

Beaumont also pointed out a glaring inconsistency: Microsoft has hired security researchers with criminal hacking convictions on their records and has purchased exploits from brokers. The company has employed people who publicly posted zero-day exploits. If publishing proof-of-concept code is criminal activity, Microsoft has done business with — and employed — criminals.

The Researcher’s Side

Nightmare Eclipse claims the public disclosures were retaliation. In a blog post, the researcher wrote that Microsoft had previously threatened to “ruin my life” and revoked access to their MSRC account — the portal where researchers report vulnerabilities.

“Normally, I would go through the process of begging them to fix a bug,” Nightmare Eclipse wrote, according to PCMag, “but to summarize, I was told personally by them that they will ruin my life and they did.”

These claims are unverified. A Microsoft spokesperson told Windows Central that “Microsoft does not remove MSRC researcher portal accounts” and that the company “cannot confirm which account this person is claiming was deactivated.” What is verifiable is that Nightmare Eclipse’s accounts on GitHub (owned by Microsoft), GitLab, and the MSRC portal were all disabled.

As Beaumont noted: “It’s quite difficult to ‘responsibly’ report future vulnerabilities when you have been banned.”

A Chilling Precedent

Katie Moussouris, founder of Luta Security, pioneered bug bounty programs at Microsoft in the late 2000s. She explicitly moved the industry away from the language of “responsible disclosure” — the exact phrasing Microsoft invoked — in favor of “coordinated disclosure.” The distinction matters. “Responsible” frames the researcher as morally obligated to the vendor. “Coordinated” acknowledges that both sides have work to do.

“Invoking the term ‘responsible’ disclosure was the first strike in my book,” Moussouris told TechCrunch. “Adding a threat of prosecution by mentioning [Digital Crimes Unit] was over the top, and will only result in security researchers distrusting Microsoft.”

She warned of a chilling effect: fewer researchers coming forward, fewer bugs reported, worse security for everyone.

The Power Asymmetry

This is not a clean story. Nightmare Eclipse may well be a disgruntled former employee — some of their posts suggest as much. Publicly dropping working exploit code before a patch exists puts real people at real risk. Microsoft is not wrong about that.

But a trillion-dollar company invoking its Digital Crimes Unit against a single researcher — while simultaneously disabling every channel that researcher might use to report bugs privately — is not a security strategy. It is an intimidation strategy.

Beaumont put it plainly: “If Microsoft’s tactic is to try to criminalise not following often arbitrary ‘responsible disclosure’ frameworks, good luck defending that in court — because there’s a whole clown car of prior decision making within Microsoft and facts which would emerge in that process.”

The bugs are real. The patches are not all shipped. And Microsoft has chosen to fight this battle with lawyers instead of engineers.

Sources