Tia N.List

Reported by 2 outlets

GreatXML: Eighth Nightmare Eclipse Zero-Day — Turns Defender Offline Scan Into BitLocker Backdoor, No Patch Available

hot0.0
Why this score
Breadth
1.00 / 2.0 · 2 sources
Authority
1.20 / 2.0 · best outlet weight
Severity
0.80 / 5.0 · CVSS + content signals
Velocity
0.00 / 2.0 · updates in 48h
Pickup speed
0.00 / 0.6 · time to second source
Recency
× 0.00 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
0.0 / 10 = base × recency + community
malware.newscyber.netsecops.io first seen 124d ago

Timeline

  1. original reporting

    GreatXML: Eighth Nightmare Eclipse Zero-Day — Turns Defender Offline Scan Into BitLocker Backdoor, No Patch Available

    malware.news · 124d ago · June 12th, 2026

    Just one day after publishing RoguePlanet, the researcher operating as MSNightmare/Nightmare Eclipse (now "Chaotic Eclipse") released GreatXML — a BitLocker bypass that exploits the Windows Recovery Environment state left behind after Microsoft Defender Offline Scan runs on a system. The exploit uses a planted unattend.xml plus a modified Recovery directory at the root of the recovery partition. Any subsequent reboot into WinRE (via Shift+Restart from the lock screen) spawns an unrestricted shell with full access to the BitLocker-encrypted volume — no credentials required. Verified on Windows 11 24H2 with BitLocker active.

    Key implications:

    • Precondition: A Defender offline scan must have been run on the target at any prior point — triggering the vulnerable WinRE state.

    • Post-compromise persistence tool: Requires admin rights to plant the files, but once planted, the bypass survives credential rotation, incident response, and loss of remote access. The attacker can return with physical access and unlock the disk.

    • No CVE, no patch. This is the eighth tool from the Nightmare Eclipse cluster in roughly 10 weeks, and the second BitLocker bypass after YellowKey.

    • RoguePlanet context: Also published this week (June 10), RoguePlanet is a separate LPE granting SYSTEM via a Microsoft Defender TOCTOU race condition on fully patched Windows 10/11. Not yet patched.

    Action: Monitor for unexpected files at recovery partition root (unattend.xml, modified Recovery/ directory). Organizations with high-value laptops should consider physical security controls and post-boot integrity verification.

  2. update from cyber.netsecops.io

    📰 Researcher 'Nightmare Eclipse' Drops Three LPE Zero-Day Exploits Researcher 'Nightmare Eclipse' drops 3 LPE zero-day exploits for CrowdStr

    cyber.netsecops.io · 35d ago · September 8th, 2026

    📰 Researcher 'Nightmare Eclipse' Drops Three LPE Zero-Day Exploits Researcher 'Nightmare Eclipse' drops 3 LPE zero-day exploits for CrowdStr

    via Mastodon https://cyber.netsecops.io/articles/nightmare-eclipse-discloses-zero-day-exploits-in-crowdstrike-avast-nvidia/?utm_source=mastodon&utm_medium=social&utm_campaign=daily

Source on GitHub