Nightmare-Eclipse publicly released two new Windows zero-days, YellowKey and GreenPlasma, that can break BitLocker protection and escalate a standard user to SYSTEM, respectively. The article also links them to earlier tools like BlueHammer, RedSun, and UnDefend, and warns that the full Nightmare-Eclipse toolkit is already being actively used in intrusions. #YellowKey #GreenPlasma #NightmareEclipse #BlueHammer #RedSun #UnDefend
Keypoints
- Nightmare-Eclipse publicly released two new Windows zero-days: YellowKey and GreenPlasma.
- YellowKey bypasses BitLocker by abusing Windows Recovery Environment behavior, enabling access to encrypted volumes via physical access and a USB drive.
- GreenPlasma targets CTFMON to achieve SYSTEM-level privilege escalation from a standard user account without credentials or admin rights.
- Microsoft had not yet patched YellowKey or GreenPlasma at the time of writing.
- The new disclosures build on earlier Nightmare-Eclipse releases, including BlueHammer, RedSun, and UnDefend, which are reported as actively exploited.
- The article describes attack chains that combine initial access, privilege escalation, defense evasion, and data theft using the full toolkit.
- Recommended mitigations include patching, disabling USB boot, enforcing BitLocker TPM+PIN, strengthening detection, and auditing VPN and Defender activity.
MITRE Techniques
- [T1068 ] Exploitation for Privilege Escalation – GreenPlasma is used to gain SYSTEM privileges from a standard user account by abusing CTFMON and attacker-controlled memory sections (‘standard user context → SYSTEM without interactive admin prompt’).
- [T1068 ] Exploitation for Privilege Escalation – RedSun and BlueHammer are both described as paths from standard user to SYSTEM through exploitation of Windows components (‘Standard user context → SYSTEM without interactive admin prompt’).
- [T1003 ] OS Credential Dumping – BlueHammer is said to yield SAM hive access and enable harvesting of NTLM hashes, LSASS, and cached domain credentials (‘SAM hive access yields NTLM hashes’ / ‘credential harvesting (SAM, LSASS, cached domain credentials)’).
- [T1078 ] Valid Accounts – Initial access is described as using compromised credentials, including FortiGate SSL VPN stolen accounts (‘compromised credentials (observed: FortiGate SSL VPN with stolen account)’).
- [T1562.001 ] Impair Defenses: Disable or Modify Tools – UnDefend blocks Microsoft Defender updates and can make Defender stop responding, weakening endpoint protections (‘silently blocks Microsoft Defender’s signature and definition updates’ / ‘Microsoft Defender stops responding entirely’).
- [T1021 ] Remote Services – The intrusion chain mentions VPN access and lateral movement using stolen credentials or pass-the-hash for continued access (‘FortiGate SSL VPN’ / ‘lateral movement using pass-the-hash or stolen credentials’).
- [T1075 ] Pass the Hash – BlueHammer is described as enabling pass-the-hash after NTLM hash acquisition (‘Pass-the-hash achieves SYSTEM’).
- [T1105 ] Ingress Tool Transfer – Attackers stage payloads such as BlueHammer, RedSun, GreenPlasma, and UnDefend from user-writable directories and USB media (‘stages the BlueHammer payload in a user-writable directory’ / ‘A USB containing the YellowKey payload is inserted’).
- [T1204 ] User Execution – YellowKey requires user actions such as rebooting into WinRE and entering a key combination to trigger the exploit (‘The attacker forces or waits for a reboot into the WinRE’ / ‘A specific key combination is entered’).
- [T1547 ] Boot or Logon Autostart Execution – The article notes persistent implant staging on disk before reboot and execution on the next user logon (‘a persistent implant or modified executable can be placed on the drive before rebooting’).
- [T1036 ] Masquerading – The toolkit includes renamed binaries like FunnyApp.exe and z.exe to blend in (‘observed: FunnyApp.exe’ / ‘z.exe’).
- [T1001 ] Data Obfuscation – The article mentions using alternative process names and renamed variants to evade straightforward detection (‘Add detection for renamed variants’).
Indicators of Compromise
- [Filename ] Public exploit and tool names – YellowKey.exe, GreenPlasma.exe, and other related binaries such as RedSun.exe, BlueHammer.exe, UnDefend.exe
- [Filename ] Observed renamed binaries – FunnyApp.exe, z.exe, and agent.exe (BeigeBurrow)
- [File Path ] BlueHammer/RedSun staging locations – C:Users*Pictures, C:Users*Downloads[2-char subfolder]
- [File Path ] System file targets to monitor – C:WindowsSystem32TieringEngineService.exe, C:WindowsSystem32ctfmon.exe
- [Process ] UnDefend launch chain – cmd.exe spawned by explorer.exe executing UnDefend.exe -agressive
- [Process ] GreenPlasma behavior – CTFMON creating or interacting with unexpected memory sections
- [Behavior ] YellowKey exploitation effect – shell spawning from WinRE with unrestricted volume access
- [Behavior ] Defender tampering – Microsoft Defender update suppression without hard failure alert
- [URL ] Public repository location – github.com/Nightmare-Eclipse/*
- [IP Address ] Intrusion infrastructure – Russia-geolocated source IPs, with specific address redacted