Hacker Publicly Discloses Two Windows Zero-Day Vulnerabilities on Patch Tuesday

A hacker known by the monikers Chaotic Eclipse and Nightmare Eclipse publicly disclosed two zero-day exploits named YellowKey and GreenPlasma in synchronization with Microsoft's Patch Tuesday release this month. Microsoft did not patch any in-the-wild vulnerabilities in the update.

Both YellowKey and GreenPlasma exploit proof-of-concept codes were used in active attack campaigns within 24 hours of the public proof-of-concept code being published.

YellowKey is a Windows BitLocker encryption bypass zero-day exploit. GreenPlasma is a Windows CTFMON arbitrary section creation elevation of privileges vulnerability. The day after Microsoft Patch Tuesday is known as Exploit Wednesday.

The disclosures continue a pattern. Chaotic Eclipse publicly released exploit code for a zero-day named BlueHammer in April that turned Microsoft Defender’s update workflow into a credential theft mechanism. The hacker has expressed escalating frustration with the Microsoft Security Response Center.

“Microsoft has chosen to make this worse instead of resolving the situation like adults, they pulled every childish game possible. My patience is running out you're making everyone else paying for it,” Chaotic Eclipse stated. ” The hacker also warned the Microsoft Security Response Center: “Your recent actions made me take the difficult decision to drag other companies into this, be prepared to answer questions.

Next Patch Tuesday will have a big surprise for you, Microsoft. ” Neena Sharma, a cybersecurity specialist at Filigree, advised organizations to assess their exposure immediately, particularly for devices in high-risk physical access scenarios such as field devices and shared workstations.