A developer known as NightmareEclipse has released a tool named BigDiskBuster designed to block updates for Microsoft Defender. The utility operates in the background, preventing the antivirus from downloading new definitions by filling disk space when an update attempt is detected. It also targets the MRT.exe process, which handles malicious software removal.
The developer states that the current version of BigDiskBuster is a prototype and remains somewhat unstable. The tool is compatible with Windows 11 and Windows 10. It functions by monitoring for update requests and triggering an error, such as 0x80070643, to force the process to terminate. Once the update fails, the utility clears the temporary files it created.
This software is a successor to an earlier project called UnDefend. The developer has been publicly disclosing vulnerabilities in Microsoft software since the spring of 2026. Over the past few months, NightmareEclipse has reported more than 10 vulnerabilities, including zero-day flaws in Defender, and released several exploits such as RoguePlanet, LegacyHive, ShieldBreak, and ShieldCrash.
The actions follow a legal dispute where Microsoft previously attempted to sue the developer for disclosing security flaws. Although the company later withdrew the lawsuit due to negative community feedback, the developer continues to publish information about software vulnerabilities and develop tools that interfere with Microsoft security components.
