MalwareExploits 1 CVE

GreenPlasma

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-45586GreenPlasma / Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege

CVE-2026-45586 – Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability ... Microsoft judges two of them (CVE-2026-45585, CVE-2026-45586) as more likely to be exploited within the next 30 days. | Microsoft connects these four CVEs to specific items disclosed by the Chaotic Eclipse researcher earlier this month – respectively, these touch MiniPlasma, RedSun, YellowKey, and GreenPlasma.

via sophos threat researchsophos.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

T1574.010Services File Permissions WeaknessEvidence1

This is a classic link-following (improper link resolution before file access) flaw turned into a privilege escalation weaponized through Defender’s own file handling behaviour.

Persistence

2 techniques

T1112Modify RegistryEvidence1

Blackfort Technology confirmed the strongest IOCs are the registry artifacts. The BlockedApps key created as a volatile REG_LINK and SymbolicLinkValue pointing to ...\Policies\System showed the best signal-to-noise ratio in testing.

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

Privilege Escalation

4 techniques

T1055Process InjectionEvidence1

As for GreenPlasma, it's supposed to get an attacker full system-level access ... by manipulating the CTFMon process into placing a crafted memory section object ... in any Windows' Object Manager section the SYSTEM user has write access to, bypassing regular access controls.

T1068Exploitation for Privilege EscalationEvidence8

CVE-2026-41091 – Microsoft Defender Elevation of Privilege Vulnerability ... CVE-2026-45586 – Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability ... CVE-2026-41091 Microsoft Defender Elevation of Privilege Vulnerability Exploitation detected

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

T1548.002Bypass User Account ControlEvidence2

The attacker executes conthehost.exe using the runas verb (ShellExecuteEx). This then forces Windows to switch desktops to show the UAC elevation prompt.

Stealth

4 techniques

T1055Process InjectionEvidence1

T1211Exploitation for Defense EvasionEvidence1

CVE-2026-50507 is a Windows BitLocker bypass that can only be exploited by attackers who have physical access to target devices. (This is believed to be the vulnerability exploited by Nightmare Eclipse’s “GreenPlasma” exploit.) CVE-2026-45585, another Windows BitLocker bypass, has also received a fix. Microsoft acknowledged ... this is the fix for the vulnerability exploited by Nightmare Eclipse’s “YellowKey” exploit.

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

T1574.010Services File Permissions WeaknessEvidence1

This is a classic link-following (improper link resolution before file access) flaw turned into a privilege escalation weaponized through Defender’s own file handling behaviour.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

With SYSTEM access and Microsoft Defender degraded, the attacker proceeds to credential harvesting (SAM, LSASS, cached domain credentials)

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

sophos threat researchNews

Jun 11, 2026

June Patch Tuesday smashes past 500-CVE mark | SOPHOS

Named item tied to CVE-2026-45586 in the Chaotic Eclipse disclosures; Sophos lists detection as Troj/GrPlasma-A.

detectNews

May 23, 2026

Detection Logic Bugs, Developing Context to Bypass MiniPlasma Rules | by Nikolas Bielski | May, 2026 | Detect FYI

A Windows local privilege escalation exploit/tool that abuses a predictable shared memory object path during the UAC secure desktop switch by pre-planting a symbolic link, allowing a low-privileged process to obtain a handle to a SYSTEM-created section object and redirect execution flow to spawn a payload.

levelblue spiderlabs blogNews

May 22, 2026

From WinRE to SYSTEM: Hunting the YellowKey and MiniPlasma Attack Chain

A proof-of-concept technique for privilege escalation through Windows object manager behavior, creating attacker-controlled section objects in trusted namespaces via symbolic links and CTF-related namespace interactions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

GreenPlasma

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2026-45586GreenPlasma / Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege

via sophos threat researchsophos.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

T1574.010Services File Permissions WeaknessEvidence1

This is a classic link-following (improper link resolution before file access) flaw turned into a privilege escalation weaponized through Defender’s own file handling behaviour.

Persistence

2 techniques

T1112Modify RegistryEvidence1

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

Privilege Escalation

4 techniques

T1055Process InjectionEvidence1

T1068Exploitation for Privilege EscalationEvidence8

T1543Create or Modify System ProcessEvidence1

The exploit calls NtCreateSymbolicLinkObject to plant a malicious symlink at that location before the desktop switch completes.

T1548.002Bypass User Account ControlEvidence2

The attacker executes conthehost.exe using the runas verb (ShellExecuteEx). This then forces Windows to switch desktops to show the UAC elevation prompt.

Stealth

4 techniques

T1055Process InjectionEvidence1

T1211Exploitation for Defense EvasionEvidence1

T1574Hijack Execution FlowEvidence2

With a handle to memory that a SYSTEM process is actively reading and executing, the attacker can manipulate its contents to redirect execution flow and spawn their payload.

T1574.010Services File Permissions WeaknessEvidence1

This is a classic link-following (improper link resolution before file access) flaw turned into a privilege escalation weaponized through Defender’s own file handling behaviour.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

With SYSTEM access and Microsoft Defender degraded, the attacker proceeds to credential harvesting (SAM, LSASS, cached domain credentials)

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

sophos threat researchNews

Jun 11, 2026

June Patch Tuesday smashes past 500-CVE mark | SOPHOS

Named item tied to CVE-2026-45586 in the Chaotic Eclipse disclosures; Sophos lists detection as Troj/GrPlasma-A.

detectNews

May 23, 2026

Detection Logic Bugs, Developing Context to Bypass MiniPlasma Rules | by Nikolas Bielski | May, 2026 | Detect FYI

levelblue spiderlabs blogNews

May 22, 2026

From WinRE to SYSTEM: Hunting the YellowKey and MiniPlasma Attack Chain

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.