YellowKey & GreenPlasma — Unpatched Windows BitLocker Bypass & CTFMON LPE Zero-Days With Public PoC (Chaotic/Nightmare Eclipse) — Threadlinqs Intelligence
As of 2026-05-30, YellowKey & GreenPlasma — Unpatched Windows BitLocker Bypass & CTFMON LPE Zero-Days With Public PoC (Chaotic/Nightmare Eclipse) is a critical-severity zero day threat attributed to Chaotic Eclipse, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0512 · Severity: CRITICAL · CVSS: 9.3 · Status: ACTIVE · Category: ZERO_DAY
Attribution: Chaotic Eclipse · HACKTIVISM
On May 13, 2026, the researcher Chaotic Eclipse (GitHub: Nightmare-Eclipse) published two unpatched Windows zero-day exploits as a protest against Microsoft's vulnerability handling. YellowKey is a
OVERVIEW
On May 13, 2026, the security researcher who self-identifies as "Chaotic Eclipse" (GitHub handle Nightmare-Eclipse) publicly released proof-of-concept exploit code for two unpatched Microsoft Windows zero-day vulnerabilities — YellowKey, a BitLocker authentication/encryption bypass, and GreenPlasma, a kernel-assisted local privilege escalation. The disclosure was performed without coordinated vulnerability disclosure (CVD); the researcher cites dissatisfaction with Microsoft's bug-handling and has publicly promised to leak additional Windows exploits, including "a big surprise" for the next Patch Tuesday. The repository (github.com/Nightmare-Eclipse/YellowKey) reached 999 stars and 225 forks within hours of publication.
The disclosure follows the same actor's prior releases: BlueHammer (CVE-2026-33825, Microsoft Defender LPE via TOCTOU on the file-remediation engine, patched April 2026), RedSun (a sibling Defender LPE that was silently patched), and UnDefend. Huntress Labs (May 2026) reported all three of those prior PoCs were observed in real-world intrusions within weeks of disclosure, making operational weaponization of YellowKey and GreenPlasma highly probable.
YELLOWKEY — TECHNICAL ANALYSIS (BITLOCKER BYPASS)
YellowKey exploits a logic flaw in the Windows Recovery Environment (WinRE) boot image that is not present in the equivalent components of the mainline OS install — the researcher and several independent reviewers (Will Dormann/Analygence, Kevin Beaumont) note that the same code in normal Windows lacks the exploitable behavior, leading the researcher to credit, sarcastically, "MORSE, MSTIC, and Microsoft GHOST" and to describe the component as an apparent backdoor.
Root cause (per Will Dormann's reproduction): WinRE, on boot, enumerates attached volumes and replays NTFS Transactional Resource Manager (TxR) logs found in each volume's "\System Volume Information\FsTx\<GUID>\" directory. The exploit ships a precrafted FsTx directory (GUID 95F62703B343F111A92A005056975458) containing FsTxLogs/ and FsTxTemp/ subdirectories whose log records, when replayed, cause WinRE's RAM disk image (X:\) to drop or overwrite X:\Windows\System32\winpeshl.ini. Because winpeshl.ini specifies the recovery interface to launch, its absence causes WinRE to fall back to launching cmd.exe — and crucially, by this point WinRE has already invoked the TPM-sealed VMK and mounted the BitLocker volume read/write at C:\. The attacker is dropped into an unrestricted SYSTEM command prompt with full access to the plaintext BitLocker volume — no recovery key, no PIN, no unlock prompt.
Exploitation procedure (USB variant):
1. Attacker formats a FAT32/NTFS USB stick.
2. Copies the YellowKey FsTx folder verbatim to <USB>:\System Volume Information\FsTx\95F62703B343F111A92A005056975458\.
3. Inserts USB into the target machine (powered on at the lock screen, or off).
4. Holds Shift and clicks Restart -> Troubleshoot -> Advanced -> WinRE.
5. Releases Shift on click; immediately holds CTRL and keeps holding it through reboot.
6. If timing aligns, WinRE drops to a cmd.exe shell with the BitLocker C:\ volume mounted.
Exploitation procedure (EFI variant — bypasses "no removable media" GPO):
1. Attacker removes the disk from the target machine.
2. Mounts the EFI System Partition on a controlled workstation.
3. Writes the FsTx folder to the EFI partition (path not publicly disclosed in full).
4. Re-installs the disk and boots normally; WinRE replay path is hit during the next recovery cycle.
Will Dormann reproduced the USB variant but did not reproduce the EFI variant in his testbed.
TPM+PIN: Chaotic Eclipse states the exploit "still works in TPM+PIN environments" but withheld the TPM+PIN trigger variant. The disclosed USB/EFI variant is reported to work against TPM-only configurations, which are the Windows 11 default.
GREENPLASMA — TECHNICAL ANALYSIS (CTFMON ARBITRARY SECTION CREATION LPE)
GreenPlasma is described by the researcher as a "Windows CT
Weaknesses (CWE)
CWE-284, CWE-269, CWE-668, CWE-274, CWE-732
Target sectors: government, financial, healthcare, defense, energy, technology, education, legal, manufacturing, telecom, msp, law-enforcement
Target regions: Global, North America, Europe, Asia-Pacific
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ZERO_DAY, CRITICAL, threat intelligence, cybersecurity, T1091, T1200, T1059, T1106, T1542, T1542, T1068, T1548, T1542, T1006