Microsoft vs Nightmare Eclipse

I heard about this, as I work for the competition. I know several people who work at Microsoft, where this is not only a major security breach, the researcher has publicly leaked six unpatched Windows zero-day vulnerabilities, complete with weaponized exploit code, which could ultimately bring Windows down.

Forensically, the only realistic "hail Mary" Microsoft has to catch the researcher is to audit if they ever tried to cash out a bug bounty from Microsoft in the past, or used cryptocurrency to buy domain names, hosting, or VPN services for their leaks. Ultimately, Microsoft could follow the blockchain. Microsoft would have to utilize highly sophisticated obfuscation methods, crypto exchanges which require know-your-Customer/ID verification.

More than likely Chaotic Eclipse is operating from a country that does not extradite to the US or cooperate with Western law enforcement such as Russia, China, or Iran, they may never be physically arrested, even if the FBI figures out exactly who they are. Guaranteed, Chaotic Eclipse is way ahead of ever being caught.

If Microsoft would stop being such shite bags about their bug bounty program. I personally know a few people that have submitted valid bugs. Instead of getting their money, Microsoft tried to get away with sending them socks and t-shirts. They had to threaten legal action before Microsoft finally paid.

Microsoft has bigger issues than chasing the guy.

Looking at that blue hammer link, all they did was flag the POC signature, they're not checking for what it does, and all those pieces by themselves are working by design in windows.

You can view the Nightmare Eclipse source code via underground channels, after the account was banned by Github and Gitlab. The source code is not highly complex, foundational malware from scratch, instead they wrote exploit scripts and automation tools primarily using the PowerShell CLI and C++ designed to abuse native Windows administrative features and misconfigurations.

They utilized the NT AUTHORITY\SYSTEM script. The script targeted known but unpatched logic flaws in the Windows kernel and subsystem communication. Moreover, the code would trick the operating system into executing a command or spawning a new command prompt under the context of a privileged system service rather than the limited user account.

Nightmare Eclipse utilized additional scripts in C++ to Windows Defender’s own CLI interface to effectively blind the antivirus, allowing any subsequent malware to run completely undetected.

The Powershell and C++ code is not overly complex from a logic standpoint, instead the reliability and automation of the scripts were well written from an execution standpoint. The code was written so cleanly that threat actors didn't need to tweak it; you could simply download the scripts from the public repositories and immediately embed them into automated ransomware deployment chains.