"Made a funny tool, completely denies defender from updating so you're stuck with your current version if the tool is running in the background," NightmareEclipse said.
BigDiskBuster: a proof-of-concept that stops Defender updates
Security researcher NightmareEclipse, who also goes by Abdelhamid Naceri, published a proof-of-concept called "BigDiskBuster" that is designed to prevent Microsoft Defender Antivirus from installing platform and security intelligence updates. The researcher described the tool as similar to an earlier project called "UnDefend" and said the current PoC is "a bit buggy and needs some rewritting [sic]." NightmareEclipse also claimed it works on "all supported versions of Windows," a compatibility assertion the researcher made publicly but which has not been independently verified.
How BigDiskBuster interferes with updates
BigDiskBuster does not disable Microsoft Defender. Instead, the PoC waits for an update process to start and then attempts to exhaust available disk space so the update cannot complete. According to the published code and the researcher's description, the tool creates hidden temporary files sized to consume the drive's free space and spins up additional threads as needed to claim more space. When it detects the Defender update has failed, the PoC closes the files and returns the space.
The tool also opens Microsoft's Malicious Software Removal Tool executable, MRT.exe, in a way that restricts other processes' access to the file while that handle remains open. NightmareEclipse says the combined effect is that Defender remains running but is "stuck" on its current platform and security intelligence versions for as long as the interference continues.
A screenshot released with the PoC shows Windows Security reporting a protection definition update failure with error 0x80070643. The report notes that 0x80070643 is a generic installation error and is not, by itself, proof that BigDiskBuster is the cause of any given failure.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhere BigDiskBuster sits in a larger public feud
BigDiskBuster arrives amid an ongoing and very public dispute between NightmareEclipse and Microsoft. The researcher began publishing Windows zero-days and proof-of-concept code in April, saying Microsoft had mistreated them and cut off access to its vulnerability reporting portal. Microsoft responded in May by criticizing the public releases and asserting that none of the initial bugs had been reported through its official channels. The company also invoked its Digital Crimes Unit at the time, language that was widely interpreted as a threat of legal action against the researcher.
Microsoft later walked back that rhetoric, saying it had "no intention to pursue action against individuals conducting or publishing security research." By then, however, NightmareEclipse's earlier GitHub account had been taken down and the researcher had lost access to Microsoft's vulnerability reporting portal. Despite the tensions, NightmareEclipse continued to publish exploit code: releases named RoguePlanet in June, LegacyHive in July, ShieldBreak in August, and ShieldCrash in September. According to the public record, several of the earlier zero-days have since been patched by Microsoft, while some were exploited in the wild after their public disclosure.
BigDiskBuster differs from those previous PoCs. Rather than providing an exploit path to SYSTEM privileges, it targets a basic operational capability of antivirus software: its ability to update itself. As of this report, there is no indication BigDiskBuster has been used in real-world attacks, and Microsoft "Redmond" has not responded to The Register's questions about the tool.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: will notice a shift in researcher-released techniques from privilege-escalation exploits to mechanisms that disrupt update delivery. Teams will need to watch for repeated definition-update failures and unusual disk-consumption patterns that coincide with update attempts.
- Affected enterprises and procurement leaders: should be aware that an antivirus process can remain active while its security intelligence lags; an up-to-date signature set is central to detecting recently identified malware, so prolonged failures to install updates reduce detection currency.
- End users and the general public: may see Windows Security reporting generic update installation errors such as 0x80070643; while that code does not prove BigDiskBuster activity, repeated failures that resolve when nonstandard handles or temporary files are removed could merit further investigation by support teams.
NightmareEclipse's BigDiskBuster is a notable tactical pivot: instead of publishing another exploit that seeks system-level control, this PoC aims to keep defenders operating with stale intelligence. The claim that it works across all supported Windows versions remains unverified, and there are no confirmed in-the-wild uses reported to date. Microsoft has not answered questions submitted by The Register, leaving the disclosure and its operational implications unresolved in public.
For now the immediate facts are straightforward — a publicly posted PoC can prevent Defender from completing updates by exhausting disk space and locking a key cleanup executable, the researcher says, and the broader confrontation between the researcher and Microsoft continues to produce high-profile code releases. Whether BigDiskBuster will move from proof-of-concept to weaponized use, or prompt a technical response from Microsoft, remains to be seen.
