Starting in April 2026, a disgruntled security researcher going by aliases such as “Chaotic Eclipse” and “Nightmare Eclipse” began releasing potent Windows privilege escalation vulnerabilities and proof-of-concept (PoC) exploit code to the public. These releases occurred outside of a typical vulnerability disclosure process, where a vendor would have the opportunity to construct a patch remediating the vulnerability prior to the vulnerability’s public release.
As these vulnerabilities were “zero-days”, this left a critical window of opportunity for threat actors to utilise these public exploits within their campaigns to degrade antivirus and escalate privileges after achieving initial access on a Windows workstation or server.
Zero-day vulnerabilities and other emerging threats feed into the cyber threat intelligence (CTI) utilised by Bastion during the planning of adversarial simulation exercises. Incorporating the latest CTI during the planning and execution phases ensures that exercises closely emulate the current tactics employed by cyber threat actors, as well as the wider threat landscape.
Exploiting YellowKey to Escalate Privileges and Impair Defences
One of these exploits, “YellowKey”, allows a BitLocker drive to be accessed through an Administrator command prompt within the Windows Recovery Environment (WinRE). Access to an unlocked BitLocker-encrypted drive within the WinRE would usually require the user to supply the BitLocker recovery key for the drive.
With access to the unlocked system drive, sensitive files which would usually be protected while operating Windows normally can be tampered with in WinRE. Bastion has utilised this on Adversarial Simulation engagements to drop command and control (C2) implants. We have successfully added a compromised account to the local Administrators group, and disabled EDR products by inserting Windows Defender Application Control (WDAC) policies preventing the EDR’s components from ever starting. For more information about blocking security products using WDAC, see Utilising WDAC to bypass Microsoft Defender.
As exploitation occurs within WinRE regular system logging does not occur making detection difficult. This highlights the importance of assuming breach and ensuring adequate detection of post-exploit attacker behaviour.
Obfuscating MiniPlasma
MiniPlasma exploits an incomplete fix for a previous CVE, CVE-2020-17103, exploiting the Windows Cloud Filter driver to escalate privileges by spawning a SYSTEM command prompt.
While detections were added to Windows Defender to detect the original PoC, Bastion was able to modify the exploit to execute undetected, achieving local privilege escalation on an initial foothold. By applying techniques such as string obfuscation and Import Address Table (IAT) hashing to hide suspicious imports, the original PoC could be modified to evade Defender’s static detection rules.
Conclusion
Microsoft released fixes for YellowKey, MiniPlasma, and a third (GreenPlasma) in Microsoft’s June 2026 “Patch Tuesday” release.
“Nightmare Eclipse” has continued releasing new Windows exploits, their latest release at the time of writing this article being “LegacyHive” which could allow a threat actor with standard privileges to mount another user’s registry hive and escalate privileges.