YellowKey, GreenPlasma & Teams: The Chaotic Eclipse Campaign and the BitLocker Bypass in Detail

On May 13, 2026, a bundle of two Windows zero-days and a vulnerability in Microsoft Teams was published under the name "Chaotic Eclipse". The most spectacular component: YellowKey, a BitLocker bypass that circumvents Windows disk encryption on patched devices. For anyone who considers BitLocker their last line of defense against device loss, theft or insider risk, this is a heavy blow. This article traces the publication, explains the technical background and shows which immediate measures Swiss companies should take now.

What was published on May 13, 2026?

The research group Nightmare-Eclipse published three separate vulnerabilities under the codename "Chaotic Eclipse" that together form a complete attack chain, from initial access to the permanent compromise of encrypted data. Specifically, they are:

Taken on its own, each of these three vulnerabilities would be explosive. Combined, they form a complete chain: Teams gets the attacker onto the endpoint, GreenPlasma elevates privileges to SYSTEM, and YellowKey neutralizes the last protective layer (disk encryption). In a subsequent device theft or an offline forensic analysis by an insider, the data is then unprotected.

Why a BitLocker bypass is particularly explosive

In many Swiss companies, BitLocker is the standard measure for encryption at rest on endpoint devices. Compliance requirements from the revised Swiss Data Protection Act (revDSG), FINMA Circular 23/1 (cyber risks) or ISO 27001 (A.8.24 / A.10.1) expect exactly this protective layer. Anyone who loses an encrypted notebook has, so the assumption goes, no reportable data breach within the meaning of Art. 24 FADP.

YellowKey breaks exactly this assumption. The bypass shifts the risk model in three dimensions:

• arrow_rightDevice loss and theft: Lost or stolen notebooks and tablets (on the train, in the hotel, at the office) are no longer automatically "safe because encrypted".
• arrow_rightInsiders and evil maid attacks: Anyone with brief physical access to a device (cleaning staff, events, shared offices) can exfiltrate data or plant persistence.
• arrow_rightForensic copies: Clones of hard drives (delivery returns, defective devices, disposal processes) are no longer uncritical without proper key destruction.

For regulated industries (banks, insurers, hospitals, cantonal administrations) this means: existing risk analyses and data protection impact assessments (DPIA) must be reconciled with the new threat model.

YellowKey in detail: how to classify the BitLocker bypass technically

BitLocker protects the volume with a Full Volume Encryption Key (FVEK), which in turn is encrypted with the Volume Master Key (VMK). Depending on the configuration, the VMK is released via different "key protectors": TPM-only, TPM+PIN, TPM+USB key, recovery password or Network Unlock.

This class of attacks on BitLocker is not new, but until now each of these paths had its prerequisites:

YellowKey joins a growing family of pre-boot and key extraction attacks. Until an official classification with CVE ID, affected builds and exact preconditions is available, the pessimistic approach applies from a defender's perspective: standard BitLocker configurations (especially TPM-only without PIN) are no longer sufficient.

GreenPlasma: privilege escalation on current Windows builds

The second component, GreenPlasma, is a local privilege escalation. It takes an attacker from a normal user context (for example a loader launched via a phishing email or a Teams message) to SYSTEM, the highest local privilege level.

An LPE alone is not a complete attack, but it is a critical multiplier. It enables:

• arrow_rightDisabling or manipulating EDR/AV services (see our analysis of EDR killers)
• arrow_rightReading local LSASS credentials, providing a springboard to domain privileges
• arrow_rightDeploying drivers and kernel components required for BitLocker-related operations
• arrow_rightStable persistence via services, scheduled tasks or WMI subscriptions

The MS Teams vulnerability: initial access via the most trusted channel

Microsoft Teams is the de facto standard for internal communication in Swiss companies. That is exactly what makes the vulnerability so valuable: where email filters, web proxies and sandboxed browsers stand in between as checkpoints, a Teams message often reaches the recipient in a context classified as "trusted".

Known attack patterns against Teams include external tenant abuse (external federation), file-sharing tricks via SharePoint/OneDrive backends, fake login prompts and social engineering via compromised internal accounts. The newly published vulnerability adds a technical vector to this set; the exact details will become visible step by step, depending on responsible disclosure.

From a defender's perspective, the mitigation is pragmatic: open external access in Teams only for defined partner tenants, disable or restrictively configure external anonymous access in meetings, and treat behavior in Teams as a telemetry source, not just as a "collaboration platform".

The combined attack chain

A realistic end-to-end scenario connecting the three vulnerabilities looks like this:

Immediate measures for Swiss companies

Detection indicators at a glance

Since the official IOCs are still evolving, it is worth looking at behavior-based indicators that work independently of specific hashes or domains:

Strategic perspective: what Chaotic Eclipse reveals about modern attacks

Three observations should feed into your medium-term security strategy:

First: Protection mechanisms considered "final" (disk encryption, Secure Boot, signed drivers) are being attacked at a frequency that clearly exceeds the earlier escalation curve of these classes. What held true for FortiGate firewalls over the last 15 months (see the FortiGate attack wave) now also applies to endpoint encryption: defense-in-depth is not optional.

Second: Initial access vectors are shifting into legitimate collaboration platforms. As email filters and web proxies become tighter, attackers turn to Teams, Slack, SharePoint and Drive as entry points. Visibility across these channels must be built out on par with the classic perimeter view.

Third: Behavior-based detection is winning over signature-based detection. If EDR can be shut down by an LPE like GreenPlasma, the network (and independent identity telemetry) becomes the most honest source of observation.