One Patch Behind: Nightmare-Eclipse's ShieldCrash and the Defender Bypass That Won't Stay Fixed

In our previous blog, we analyzed four proofs of concept (PoCs) from the leak persona Nightmare-Eclipse that targeted Kaspersky, Avast, NVIDIA, and CrowdStrike, respectively.

Key Takeaways

• LevelBlue SpiderLabs analyzed four Nightmare-Eclipse proofs of concept targeting Kaspersky, Avast, NVIDIA, and CrowdStrike, finding that some patches remain incomplete.
• The ShieldCrash vulnerability enables attackers to bypass security software by exploiting weaknesses in kernel-level drivers, allowing malware to evade detection.
• Multiple vendors have issued patches, but the recurring nature of these bypass techniques suggests that endpoint security products need more robust architectural defenses.