Filling the Well: Nightmare-Eclipse's BigDiskBuster and the Defender Update That Never Lands
October 5, 2026 · LevelBlue SpiderLabs · Severity: MEDIUM
This article describes a proof-of-concept called BigDiskBuster that can stop Microsoft Defender from receiving updates by exhausting disk space. Published on GitHub by MSNightmare, it shows that Defender does not need to be disabled; simply filling the disk prevents update installation. 📌 **Analyst Note:** This technique underscores that even robust antivirus solutions can be rendered ineffective through simple resource exhaustion, emphasizing the need for disk space monitoring in addition to traditional security controls. Organizations should ensure that critical system disks have alerts for low disk
A new proof of concept called BigDiskBuster, published on GitHub on September 19, 2026, by the actor known as MSNightmare, shows that Defender doesn't need to be disabled to stop receiving updates, it just needs a much simpler dependency: disk space.
Key Takeaways
- A proof-of-concept tool called BigDiskBuster demonstrates that Microsoft Defender can be prevented from receiving updates simply by filling up disk space, without needing to disable the antivirus.
- Published on GitHub by the actor MSNightmare, this technique exploits Defender's dependency on disk space to store updates, potentially leaving systems vulnerable to new threats.
- This attack vector highlights a critical gap in endpoint protection strategies, as attackers could use low-resource methods to cripple antivirus defenses without triggering traditional alarms.