Microsoft threatens lawsuit over disclosed vulnerabilities

Microsoft is threatening legal action and law enforcement referrals against a security researcher who publicly disclosed a series of unpatched vulnerabilities in its products, a move that has drawn sharp criticism from the cybersecurity community. The researcher, who uses the handle Nightmare Eclipse, published details and exploit code for several flaws affecting Windows Defender and BitLocker disk encryption, among other products.

The disclosed vulnerabilities include those identified as BlueHammer, RedSun, UnDefend, and YellowKey. Microsoft stated in a blog post that the researcher failed to report the flaws through its coordinated disclosure process, which it described as the responsible approach. The company argued that publishing exploit details before patches were available aided malicious actors. Microsoft and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said some of the vulnerabilities have since been exploited in real-world attacks.

Microsoft warned that its Digital Crimes Unit, which handles civil actions and criminal referrals, will pursue cases against those who enable such activity. The company subsequently banned the researcher’s accounts on its...