Nightmare-Eclipse Publishes YellowKey and GreenPlasma Windows Zero-Days

Summary

Nightmare-Eclipse publicly released YellowKey, a WinRE-based BitLocker bypass requiring physical access, and GreenPlasma, a CTFMON-based privilege-escalation flaw. The article says neither was patched at publication and details their mechanics, related toolkit activity,

Key points

YellowKey targets Windows 11 and Windows Server 2025; the article describes a WinRE exploit that can provide access to a BitLocker-protected volume with physical access, a USB drive, and a reboot.
GreenPlasma affects Windows 10, Windows 11, and Windows Server interactive sessions, abusing CTFMON and an attacker-controlled memory section to enable privilege escalation.
The public GreenPlasma proof of concept was partial; the article says its publisher withheld the final SYSTEM-shell stage.
Microsoft had not patched YellowKey or GreenPlasma at the time of writing.
The article reports prior hands-on intrusions involving BlueHammer, RedSun, and UnDefend; it says BlueHammer was patched and RedSun and UnDefend remained unpatched at that time.
The article describes attack scenarios combining compromised credentials, privilege escalation, Defender tampering, credential theft, and lateral movement.
Recommended defenses include disabling USB boot, enforcing TPM+PIN for BitLocker, blocking execution from user-writable paths, and independently checking Defender update status.

Article Details

Attack Vectors: YellowKey uses physical access and a USB drive to exploit Windows Recovery Environment behavior and access BitLocker-protected volumes.
GreenPlasma exploits CTFMON through attacker-controlled memory sections to pursue local privilege escalation from a standard user account; the article says its public PoC is partial.
BlueHammer and RedSun are described as privilege-escalation paths that abuse Microsoft Defender remediation or cloud-file handling behavior.
The article describes prior intrusions gaining initial access with stolen FortiGate SSL VPN credentials.
UnDefend is described as blocking Microsoft Defender updates or causing Defender to stop responding.
Defensive Notes: Apply the April 2026 updates to address BlueHammer; the article reports that YellowKey, GreenPlasma, RedSun, and UnDefend remained unpatched at the time of writing.
Disable USB boot, use BIOS/UEFI passwords, and require TPM+PIN for BitLocker.
Use Attack Surface Reduction rules to block execution from user-writable directories such as Pictures and Downloads subfolders.
Monitor for the named exploit binaries and renamed variants, and baseline SHA-256 hashes of TieringEngineService.exe and ctfmon.exe.
Review CTFMON telemetry for unexpected child processes, memory-section interactions, or crashes.
Verify Microsoft Defender update status independently of console-reported health, and audit VPN logs for anomalous locations, off-hours authentication, or concurrent sessions.
Maintain network detection and response visibility independent of endpoint-agent health.