CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Nightmare Eclipse Windows zero-day series

campaign · campaign:nightmare-eclipse-microsoft-dcu-threat-greenplasma-miniplasmaaac

Nightmare Eclipse's 2026 public Windows zero-day drop series: YellowKey (BitLocker, later CVE-2026-45585) and GreenPlasma (CTFMON LPE) with public PoCs, MiniPlasma (cldflt.sys CfAbortHydration, claimed CVE-2020-17103 regression on fully patched Windows 11) as the third PoC; after Microsoft's Digital Crimes Unit threatened criminal action the persona threatened a further release for 14 July 2026, with GreenPlasma/MiniPlasma still unpatched.

Coverage
6
first 2026-05-15 → last 2026-07-09
Latest activity
2026-07-09
Microsoft ships the engine fix for RoguePlanet (CVE-2026-50656), the Defender SYSTEM-level LPE NCSC-CH has…
Peak priority
high
3 high · 3 notable
Targets
public-sector
sectors: public-sector, energy, water · regions: switzerland
Sources cited
16
9 hosts
2026-05-156 appearances2026-07-09

Action items (4)

Do-now tasks recorded on the entries about Nightmare Eclipse Windows zero-day series, newest first. Check the date before acting on an older one.

  • On WSUS-gated, air-gapped, offline or OT-adjacent Windows estates where Defender engine updates are deferred or pinned, verify the installed Malware Protection Engine build is ≥ 1.1.26060.3008 (e.g. via Get-MpComputerStatus AMEngineVersion) rather than assuming auto-update reached it.
    2026-07-09CVE-2026-50656
  • Continue tracking the Nightmare Eclipse zero-day series via NCSC-CH's running advisory: RoguePlanet is now fixed, but the same researcher's series has previously dropped further unpatched Defender/Windows PoCs, so treat NCSC-CH's tracker as the authority for the current fix status of each.
    2026-07-09CVE-2026-50656
  • Enforce BitLocker pre-boot PIN on all managed Windows laptops and enforce BIOS/UEFI boot password, YellowKey (no CVE) bypasses TPM-only BitLocker via WinRE with a public PoC. Group Policy path: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives > Require additional authentication at startup → Enable + require PIN. Disable WinRE access where operationally viable (reagentc /disable).
    2026-05-15CVE-2026-45585
  • Add BitLocker PIN / password protector to TPM-only-protected endpoints (CVE-2026-45585 / YellowKey). Microsoft's WinRE BootExecute registry mitigation is per-device and fragile under Windows feature updates that re-stage WinRE; the PIN/password protector closes the bypass regardless of WinRE state. Public PoC, no patch (MSRC CVE-2026-45585).
    2026-05-15CVE-2026-45585

Defender insights

What each entry about Nightmare Eclipse Windows zero-day series tells a defender to do, newest first.

2026-07-09NOTABLEMicrosoft ships the engine fix for RoguePlanet (CVE-2026-50656), the Defender SYSTEM-level LPE NCSC-CH has tracked with a public PoC since June

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

attributed to

exploits

Story timeline

  1. 2026-07-09CVE-2026-50656, Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day series
    trending-vulnerabilitiesMicrosoft ships the engine fix for RoguePlanet (CVE-2026-50656), the Defender SYSTEM-level LPE NCSC-CH has tracked with a public PoC since June
  2. 2026-06-12"GreatXML": unpatched BitLocker bypass via crafted XML on the recovery partition, PoC public, practical severity contested
    active-threats
  3. 2026-06-11"RoguePlanet" Microsoft Defender zero-day: TOCTOU race in the scan engine yields a SYSTEM shell, no CVE, no patch
    active-threats
  4. 2026-05-30Nightmare Eclipse / Chaotic Eclipse, Microsoft's Digital Crimes Unit threatens criminal action; GreenPlasma and MiniPlasma (cldflt.sys SYSTEM escalation) remain unpatched; researcher announces July 14 drop
    trending-vulnerabilitiesNightmare Eclipse / Chaotic Eclipse, Microsoft's Digital Crimes Unit threatens criminal action; GreenPlasma and MiniPlasma (cldflt.sys SYSTEM escalation)
  5. 2026-05-19Chaotic Eclipse Windows zero-days; MiniPlasma is third PoC in series; cldflt.sys CfAbortHydration path, claimed re-exploitable CVE-2020-17103 regression
    trending-vulnerabilities
  6. 2026-05-15Windows BitLocker "YellowKey" and CTFMON "GreenPlasma" zero-days: public PoC, no patch, TPM-only BitLocker bypassed
    active-threats

Hunting pivots

CVEs
CVE-2026-45585 ×2CVE-2020-17103CVE-2026-50656
Affected products
Microsoft DefenderMicrosoft Security EssentialsMicrosoft System Center Endpoint Protection
Tags
vulnerabilities ×6lpe ×5no-patch ×5poc-public ×5zero-day ×4priv-esc ×2auth-bypasspatch-available
ATT&CK techniques (5 across 3 tactics)

5 techniques observed across 5 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.2 · compare on the matrix · Navigator layer (JSON)

  • PersistencePre-OS Boot · Pre-OS Boot: System Firmware
  • Privilege EscalationExploitation for Privilege Escalation · Access Token Manipulation
  • StealthDirect Volume Access · Access Token Manipulation · Pre-OS Boot · Pre-OS Boot: System Firmware

Persistence TA0003

T1542Pre-OS Boot×1

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.

Evidence: 2026-06-12/greatxml-unpatched-bitlocker-bypass-via-crafted-xml-on-the-r · ATT&CK page ↗

T1542.001Pre-OS Boot: System Firmware×2

Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.

Evidence: 2026-06-12/greatxml-unpatched-bitlocker-bypass-via-crafted-xml-on-the-r · 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×4

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-07-09/ncsc-ch-rogueplanet-cve-2026-50656-defender-lpe-fixed · 2026-06-11/rogueplanet-microsoft-defender-zero-day-toctou-race-in-the-s · 2026-05-19/chaotic-eclipse-windows-zero-days-miniplasma-is-third-poc-in · 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

T1134Access Token Manipulation×1

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

Evidence: 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

Stealth TA0005

T1006Direct Volume Access×1

Adversaries may directly access a volume to bypass file access controls and file system monitoring. Windows allows programs to have direct access to logical volumes. Programs with direct access may read and write files directly from the drive by analyzing file system data structures. This technique may bypass Windows file access controls as well as file system monitoring tools.

Evidence: 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

T1134Access Token Manipulation×1

Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.

Evidence: 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

T1542Pre-OS Boot×1

Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system. During the booting process of a computer, firmware and various startup services are loaded before the operating system. These programs control flow of execution before the operating system takes control.

Evidence: 2026-06-12/greatxml-unpatched-bitlocker-bypass-via-crafted-xml-on-the-r · ATT&CK page ↗

T1542.001Pre-OS Boot: System Firmware×2

Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.

Evidence: 2026-06-12/greatxml-unpatched-bitlocker-bypass-via-crafted-xml-on-the-r · 2026-05-15/windows-bitlocker-yellowkey-and-ctfmon-greenplasma-zero-days · ATT&CK page ↗

Entries about Nightmare Eclipse Windows zero-day series (6)

2026-07-09 · view entry permalink →

NOTABLECVE-2026-50656

CVE-2026-50656, Microsoft Defender engine 'RoguePlanet' local privilege escalation now patched; NCSC-CH tracks the ongoing 'Nightmare Eclipse' zero-day series

NCSC-CH's running tracker on the "Nightmare Eclipse" (aka Chaotic Eclipse) researcher's 2026 zero-day PoC series was updated on 2026-07-09 to record that a CVE has been assigned to RoguePlanet: CVE-2026-50656, a local privilege-escalation vulnerability (CWE-59, improper link resolution before file access / "link following") in the Microsoft Malware Protection Engine that underpins Microsoft Defender, System Center Endpoint Protection and Microsoft Security Essentials (NCSC-CH, 2026-07-09). The researcher first disclosed RoguePlanet as an unpatched zero-day on 2026-06-10, describing a race condition in Defender that lets a local attacker "execute arbitrary code or spawn a command shell with SYSTEM-level privileges" (T1068), at which point NCSC-CH logged its status as "Proof of Concept Available, no patch available" (NCSC-CH, 2026-07-09). Microsoft's own record shows the CVE was published 2026-06-16 (CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N, rated "Exploitation More Likely", exploitation status "No") and remained without a fix for over three weeks; a revision dated 2026-07-08 confirms Microsoft has now shipped an engine update that closes it, last vulnerable Malware Protection Engine build 1.1.26050.11, first fixed build 1.1.26060.3008 (Microsoft MSRC, 2026-07-08).

Because the Malware Protection Engine (mpengine.dll) auto-updates multiple times a day by default, most estates will already carry the fixed build; Microsoft's guidance is that no manual action is normally required. The operational nuance for this constituency is the exception set: any environment where engine updates are pinned, WSUS-gated, air-gapped, or centrally deferred (System Center Endpoint Protection deployments, offline or OT-adjacent Windows hosts) should explicitly verify the installed engine version rather than assume auto-remediation occurred (Microsoft MSRC, 2026-07-08). Microsoft also notes that hosts with Defender disabled are not in an exploitable state even though vulnerability scanners flag the on-disk binaries. Triage: the exploit abuses a symlink/junction race against files Defender is actively scanning, so the telemetry class is symlink/junction creation targeting Defender scan paths and, on success, MsMpEng.exe (the engine's scan host) spawning an unexpected child process with a SYSTEM token outside the normal signature/engine-update cadence; the update-cadence anchoring is the discriminator from routine engine activity. This closes RoguePlanet specifically; NCSC-CH continues to track the wider Nightmare Eclipse PoC series as a home-region authority, which is the reason a single-host LPE closure like this one is worth surfacing to this constituency at all.

Microsoft has released an update to the Microsoft Malware Protection Engine that addresses the vulnerability identified by CVE-2026-50656.

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

Microsoft Security Response Center 2026-07-08
vulnerability09 Jul 20:38Zmulti-sourceOpen finding →
Sources: NCSC-CH / GovCERT.ch Cyber Security Hub · Microsoft Security Response Center

2026-06-12 · view entry permalink →

HIGH

"GreatXML": unpatched BitLocker bypass via crafted XML on the recovery partition, PoC public, practical severity contested

The researcher operating as Nightmare Eclipse (also tracked as Chaotic Eclipse) published GreatXML on 11 June, a working proof-of-concept that bypasses BitLocker full-volume encryption and spawns a SYSTEM command prompt inside the Windows Recovery Environment (WinRE), with no CVE assigned and no Microsoft patch available (SecurityWeek, 2026-06-11). The technique places a crafted unattend.xml at the root of the recovery partition plus a second malformed XML under Recovery/, then reboots into WinRE; the Microsoft Defender Offline scan path processes the attacker-controlled XML while the volume is unlocked. Per the researcher, "any Windows machine becomes vulnerable to GreatXML as soon as Defender's offline scanning is initiated", i.e. the bypass arms itself once an offline scan has ever run on the host (SecurityWeek, 2026-06-11). Independent researcher Will Dormann disputes the practical severity, noting that triggering the prerequisite Defender Offline scan requires an existing Windows logon with admin credentials; an attacker in that position could already disable BitLocker outright (The Register, 2026-06-11). NCSC-CH is tracking the disclosure as part of the same researcher's zero-day series (BlueHammer, RedSun, UnDefend, YellowKey, GreenPlasma, RoguePlanet, RoguePlanet covered 2026-06-11) (NCSC-CH CSH, 2026-06-11). Maps to T1542.001 (Pre-OS Boot) territory: code execution from the recovery path while the BitLocker-protected volume is mounted.

Why it matters to us: evil-maid and stolen-laptop scenarios against BitLocker-protected fleets get cheaper where an offline scan has previously run. Until a patch lands: audit recovery-partition contents for unexpected unattend.xml/ReAgent.xml modifications, require TPM+PIN pre-boot authentication on high-value mobile assets, and weigh reagentc /disable on machines where recovery capability is dispensable.

threat12 Jun 05:00Zmulti-sourceOpen finding →
Sources: SecurityWeek · The Register · NCSC-CH Security Hub

2026-06-11 · view entry permalink →

HIGH

"RoguePlanet" Microsoft Defender zero-day: TOCTOU race in the scan engine yields a SYSTEM shell, no CVE, no patch

A researcher operating as "Nightmare Eclipse" (also tracked as Chaotic Eclipse) published a working proof-of-concept named RoguePlanet on 9 June 2026, hours after Microsoft patched two of the researcher's earlier disclosures (YellowKey/CVE-2026-45585 and GreenPlasma/CVE-2026-50507) in June Patch Tuesday (BleepingComputer, 2026-06-09). RoguePlanet abuses a time-of-check/time-of-use race condition in the Microsoft Defender real-time scan engine (MsMpEng.exe, running as SYSTEM): an attacker times a file-system operation to coincide with Defender's scan pass and redirects it, achieving local privilege escalation to SYSTEM on fully-patched Windows 10 and 11 (SecurityWeek, 2026-06-10). NCSC-CH GovCERT consolidated this disclosure alongside the researcher's prior 2026 Defender drops, BlueHammer, RedSun, UnDefend, YellowKey and GreenPlasma (NCSC-CH GovCERT, 2026-06-10). The primitive requires local code execution first (a standard-user foothold is sufficient) and is reliability-limited by the race; no in-the-wild exploitation has been reported and Microsoft has not assigned a CVE or issued an advisory. Technique class: T1068 Exploitation for Privilege Escalation.

Why it matters to us: Microsoft Defender is the default endpoint protection on Windows fleets across Swiss federal and EU public-sector environments, so the affected component is universal. With no patch, detection is the control: alert on MsMpEng.exe spawning cmd.exe/powershell.exe child processes (Sysmon EID 1 / Windows 4688 with parent image in the Defender path) and on SYSTEM-context shells not tied to a service restart.

threat11 Jun 05:00Zmulti-sourceOpen finding →
Sources: BleepingComputer · SecurityWeek · NCSC-CH GovCERT

Earlier coverage (3)

2026-05-30NOTABLENightmare Eclipse / Chaotic Eclipse, Microsoft's Digital Crimes Unit threatens criminal action; GreenPlasma and MiniPlasma (cldflt.sys SYSTEM escalation) remain unpatched; researcher announces July 14 dropUPDATE (originally covered 2026-W21): Microsoft's Digital Crimes Unit issued a formal public statement on 28–29 May 2026 calling uncoordinated zero-day releases "never justifiable" and warning its DCU would "continue bringing cases against these actors and those that enable their criminal activity" (The Record …2026-05-15HIGHupdatedWindows BitLocker "YellowKey" and CTFMON "GreenPlasma" zero-days: public PoC, no patch, TPM-only BitLocker bypassedWindows BitLocker "YellowKey" zero-day (no CVE) bypasses TPM-only disk encryption via WinRE NTFS transaction replay; working PoC is public; no patch available; add BitLocker pre-boot PIN to close the current PoC (BleepingComputer, 2026-05-13).2026-05-19NOTABLEChaotic Eclipse Windows zero-days; MiniPlasma is third PoC in series; cldflt.sys CfAbortHydration path, claimed re-exploitable CVE-2020-17103 regressionUPDATE (originally covered 2026-05-15): Researcher "Chaotic Eclipse" / "Nightmare Eclipse" released a third unpatched Windows LPE PoC on 2026-05-17 (MiniPlasma) extending the YellowKey and GreenPlasma series covered in the 2026-05-15 daily (BleepingComputer, 2026-05-17; The Hacker News, 2026-05-18).

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats3
  • Vulns3

Source distribution

  • bleepingcomputer.com3 (19%)
  • msrc.microsoft.com3 (19%)
  • security-hub.ncsc.admin.ch2 (12%)
  • securityweek.com2 (12%)
  • theregister.com2 (12%)
  • attack.mitre.org1 (6%)
  • heise.de1 (6%)
  • thehackernews.com1 (6%)
  • other1 (6%)
All cited sources (16)