By multiple independent accounts, the person behind ShieldBreak once worked inside Microsoft's own security organization. Today they are running one of the most public grudge matches in recent memory against their former employer, and Windows Defender is the battlefield.
The researcher, who goes by Nightmare-Eclipse, says Microsoft buried their bug reports, denied them credit, and cut off their access. Since April 2026, they have answered by publishing one unpatched Windows zero-day after another, mostly aimed at Defender, releasing each one without warning Microsoft first. Microsoft has spent months patching what it can.
In July, it landed what looked like a real win: an emergency, out-of-cycle patch that shut down RoguePlanet, one of the researcher's SYSTEM-level exploits. On August 11, the researcher answered back. ShieldBreak does not exploit a new bug. It walks straight through the patch Microsoft built specifically to close RoguePlanet, at a 100% success rate. This is the tenth tool in the campaign, and the first time the researcher has circled back to beat a patch built specifically to stop them.
The researcher published ShieldBreak under the MSNightmare handle on GitHub on August 11, 2026, with mirrors on git.projectnightcrawler[.]dev and git.churchofmalware[.]org. This is Howler Cell's sixth report on this cluster. Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
ShieldBreak is a full patch bypass for CVE-2026-50656 (RoguePlanet), patched by Microsoft in the July 2026 Defender engine update. The PoC reports 100% success on Windows 11 25H2 and Windows Server 2025, up from RoguePlanet's inconsistent reliability.
Like RoguePlanet, ShieldBreak drives the exploit through Defender's own scan and remediation pipeline via MpClient.dll RPC calls. Where it diverges is in how the redirect and payload delivery work. ShieldBreak uses the Cloud Filter API to deliver content and switch it mid-operation: a restart hydration call swaps the bait (EICAR) for the payload DLL (Warden.dll) while Defender is mid-remediation. The redirect is constructed through the NT Object Manager namespace using symbolic links and shadowed directories, bypassing the NTFS junction layer that Microsoft's July patch targeted. A path routed through the CLFS device namespace creates a predictable artifact that anchors the redirect. The final payload lands at C:\Windows\System32\phoneinfo.dll via a UNC loopback path, and a fabricated WER crash report triggers the QueueReporting scheduled task to load it as SYSTEM.
No CVE has been assigned. No patch has been released. The behavioral chain survives recompilation and remains undetected by static means. Cyderes has built detection coverage for the chain described in this report.
ShieldBreak comes from the same researcher behind every prior tool in this series. Public identity unknown. Three aliases seen across releases and press coverage: Nightmare-Eclipse, Chaotic Eclipse, and Dead Eclipse. GitHub releases ship under the handle MSNightmare.
The real identity behind the persona has not been independently confirmed by Cyderes.
Security journalist Brian Krebs and The Register have both reported that a LinkedIn profile tied to the persona shows employment in a Microsoft security role from September 2022 to June 2025, which would make this a former-insider dispute rather than an outside researcher's grievance. The researcher has not confirmed this publicly, and other outlets have treated the claim as an unverified rumor circulating in the security community.
The releases are framed. The researcher has publicly accused MSRC of revoking portal access, dismissing submitted reports, and refusing to pay bounties on confirmed findings. Every tool in the cluster has been dropped without coordinated disclosure, most in the days immediately following a Microsoft Patch Tuesday.
ShieldBreak is the tenth tool released since the first drop on April 3, 2026, all nineteen weeks targeting Windows Defender, BitLocker, or the User Profile Service. Six of the ten aim directly at Defender. The timeline below tracks what has shipped and where each stands on patching.
Figure 1: NightmareEclipse cluster timeline, BlueHammer through ShieldBreak
ShieldBreak is a design-level race condition in how Defender's remediation pipeline interacts with cloud-filter-backed file hydration and the NT Object Manager namespace. No memory safety bug. No elevated privileges required.
Six legitimate Windows features combine to produce the exploit:
Figure 2: Howler Cell verification run, standard user to NT AUTHORITY\SYSTEM.
The vulnerability is the gap between when Defender creates a remediation artifact and when it validates where that artifact actually landed. Microsoft's July patch for CVE-2026-50656 addressed this gap at the NTFS junction layer, where RoguePlanet operated. ShieldBreak moves the entire redirect to the NT Object Manager namespace, a layer the patch does not cover. The gap still exists. ShieldBreak fills it with a namespace redirect, a controlled payload delivery via restart hydration, and a fabricated crash report that triggers SYSTEM-level execution, turning Defender's own remediation into the delivery mechanism.
The exploit checks that phoneinfo.dll does not exist in System32 (precondition for the DLL plant). The process sets itself to HIGH_PRIORITY_CLASS with THREAD_PRIORITY_TIME_CRITICAL to win scheduling races.
A named pipe \\??\\pipe\\SHIELDBREAK is created and held open for the process lifetime. The elevated payload will connect back through this pipe to signal success.
The named pipe SHIELDBREAK is a stable, observable artifact for the entire exploit duration. High-confidence detection indicator against the published PoC.
A working directory C:\ShieldBreak_<GUID> is created with the hidden attribute and an explicit ACL granting full control to the Everyone SID (required so Defender's SYSTEM-level service can write into it during remediation).
A fake cloud sync provider named Flubber (GUID {B196E670-59C7-4D41-9637-C62D80541321}) is registered on the working directory using the Cloud Filter API, the same infrastructure backing OneDrive Files On-Demand.
A placeholder file named BERLIN is created inside the working directory with its advertised size set to the embedded zip resource size.
The critical component is the fetch-data callback. When a dehydrated placeholder is opened for reading, the cloud filter triggers hydration, which fires the callback. A counter (initialized to 1 and passed as the callback context) controls what gets served:
Figure 3: Callback Architecture
The first hydration delivers the EICAR zip content to disk. Once hydrated, the file sits on disk as a normal file and subsequent reads by Defender during scanning do not trigger the callback again. The second hydration is forced later in the chain via CF_OPERATION_TYPE_RESTART_HYDRATION, which dehydrates the placeholder, resets its metadata to match the DLL size, and triggers a fresh hydration request. This time the counter is already at 2, so the callback serves Warden.dll instead.
Two object directories are created in \BaseNamedObjects\Restricted\:
Two symbolic links named WD_SCAN are placed in different directories:
Because the shadow overlays the target, the shadow's WD_SCAN wins. The target's version is hidden.
When the shadow's WD_SCAN is deleted later, the target's version becomes visible. Same path, different resolution. Defender never sees the path string change.
The scan target passed to Defender is:
The exploit opens the BERLIN placeholder via its direct working directory path with read access. Under the registered CF_HYDRATION_POLICY_FULL policy, accessing the dehydrated placeholder triggers the first cloud callback, which serves the embedded EICAR zip. The placeholder is now hydrated on disk with malicious content. This happens before the Defender scan thread is started.
ntdll.dll is copied to an NTFS Alternate Data Stream on the placeholder (BERLIN:stream). This ADS serves as a pinning mechanism later in the chain: after the payload DLL lands at C:\Windows\System32\phoneinfo.dll through the redirect, the exploit maps phoneinfo.dll:stream as an executable image section (PAGE_EXECUTE_READ | SEC_IMAGE) with an active view. This prevents the file from being deleted or replaced while the mapping is held.
The restart hydration operation is staged at this point but not executed. The CF_OPERATION_TYPE_RESTART_HYDRATION parameters are populated with new file size metadata matching Warden.dll, and the transfer key is obtained from the placeholder handle. Execution is deferred until after the namespace manipulation and CLFS lock are in place.
A worker thread loads Defender's internal client library, opens its RPC interface, and triggers a resource scan against the globalroot path. The placeholder was already hydrated with the malicious zip in Stage 4, so Defender reads it directly from disk without triggering a callback. Defender detects the threat, the worker thread confirms it, and enters the remediation pipeline.
Figure 4: Shadow link deletion on first directory change event, triggering the atomic path resolution flip
The main thread monitors the working directory for new files using ReadDirectoryChangesW:
The CLFS log file is opened and exclusively byte-range locked over the maximum range, pausing Defender mid-remediation.
With Defender paused, the final redirect is constructed:
Figure 5: CLFS log filename stripped to symlink name, redirecting to phoneinfo.dll via UNC loopback
When Defender resumes and resolves the CLFS log through the object namespace, the path hits the new directory, matches the filename symlink, and resolves through SMB loopback to phoneinfo.dll in System32.
The staged restart hydration fires, changing the placeholder's advertised size to the DLL resource size. A full re-hydration is forced. The cloud callback now serves the embedded DLL, and through the redirect chain, the content lands at C:\Windows\System32\phoneinfo.dll under Defender's SYSTEM token.
The exploit pins the payload by opening phoneinfo.dll:stream (the ADS carrying the ntdll.dll copy from Stage 4) with execute access and mapping it as SEC_IMAGE. Windows will not delete a file backing an active image section.
The remediation pipeline is then released cleanly.
A WER report directory is created at:
A crafted Report.wer is written into it. The report contains a valid-looking crash record for a fabricated application, structured to pass the WER infrastructure's format validation.
The QueueReporting scheduled task is triggered via the Task Scheduler COM interface. This task runs under SYSTEM and can be triggered by any unprivileged user. Its processing loads the planted phoneinfo.dll from System32.
The payload DLL, now executing as SYSTEM, connects back through the SHIELDBREAK pipe. The orchestrator's blocking ConnectNamedPipe unblocks and the exploit prints "Exploit succeeded."
Cyderes Detection Engineering have built behavioural coverage for ShieldBreak targeting these TTPs. Cyderes clients are protected against the behavioural chain described above
ShieldBreak is the first tool in this cluster to fully bypass a patch Microsoft shipped for a prior NightmareEclipse exploit. Microsoft's July fix for CVE-2026-50656 closed the NTFS junction-based redirect that RoguePlanet used. ShieldBreak moves the entire redirect to the Object Manager namespace, where that patch has no visibility, and replaces the probabilistic race with priority-class scheduling that achieves 100% reliability.
No kernel exploit. No memory corruption. The attack succeeds because the Cloud Filter API, Defender's remediation pipeline, the Object Manager namespace, CLFS path routing, and the WER task infrastructure can be combined in a sequence that produces a result none of them were designed to permit.
This is the tenth tool from NightmareEclipse in nineteen weeks. The pattern of dropping exploits after Patch Tuesday and bypassing patches within weeks of release should be treated as ongoing. Until a root-cause patch addressing the Object Manager redirect path and the CfApi restart hydration primitive is available, behavioral detection against the TTPs described in this report is the primary defensive control.
Howler Cell is tracking MSNightmare's ongoing activity. Findings will be updated as the situation develops.
Zero-Day PoC
Related NightmareEclipse mirrors and channels
Related Cyderes Howler Cell coverage
Indicators of Compromise
File hashes for the compiled samples are below. Both are already flagged by the Defender signatures listed above, so these specific hashes have little standalone detection value going forward. A minor recompile changes every value in this table without touching the underlying technique. Treat these as a record of what was seen in this release, not as a durable detection control, and expect new hashes and likely new evasion methods as this cluster continues.
| Algorithm | Warden.dll |
| MD5 | ff5b18a59cc71ea4274239463bf1d9d2 |
| SHA-1 | c60b42ce019d8e727e08e75690128f28583d8900 |
| SHA-256 | 691857f3f28049a7e33f5767d4e4eb3d739e1aa76c2a43c8cccadf871cfa7c1a |
| SHA3-256 | 96167fa28329360740d5cd0c72ef57090045a4e7079b404223e80c2d08b192f9 |
| SHA3-512 | 236cda33973e07189e74d5e3332ab7754b1e2e9848248925db0f4880f43a9f9684566511d3a235eeab2e1fb94e0dfa2c3c66c5dab95920aad436c1e198ab3574 |