Loading malware…
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Following GreenPlasma, YellowKey and MiniPlasma, RoguePlanet and GreatXML, and LegacyHive, the Nightmare-Eclipse disclosure actor has published ShieldBreak
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The attack requires brief physical access to the target machine, or the ability to write to the recovery partition through any other means.
GreatXML is a design-level abuse of three intersecting Windows behaviors: how WinRE processes Windows answer files... The critical execution occurs in the windowsPE pass, which runs in the pre-OS WinRE environment before any user interaction.
With the files planted and the machine in offline-scan WinRE state, the trigger is trivial and requires no credentials... On the WinRE boot, the offline-scan state causes WinRE to process the malicious unattend.xml. The windowsPE pass commands execute, the staging script runs, and a console shell spawns with access to the BitLocker-encrypted volume.
You will have to copy “unattend.xml” and “Recovery” directory to the root of the recovery partition then reboot to WinRE using shift + click on restart button, if everything was done correctly, a shell with unrestricted access to the bitlocker volume will spawn.
With a malicious unattend.xml and a modified Recovery directory planted at the root of the recovery partition, the next entry into WinRE via Shift + Restart spawns a shell with unrestricted access to the BitLocker-encrypted volume.
An unattend.xml placed at the recovery partition root in this state is processed during the WinRE boot sequence before normal security boundaries are enforced, before BitLocker prompts the user, and before any interactive logon occurs.
GreatXML is a design-level abuse of three intersecting Windows behaviors: how WinRE processes Windows answer files... The critical execution occurs in the windowsPE pass, which runs in the pre-OS WinRE environment before any user interaction.
On June 10, security researcher Chaotic Eclipse ... published a new working exploit dubbed GreatXML ... that bypasses BitLocker and opens a command shell with full SYSTEM privileges while Windows is in Recovery Mode.
You will have to copy “unattend.xml” and “Recovery” directory to the root of the recovery partition then reboot to WinRE using shift + click on restart button, if everything was done correctly, a shell with unrestricted access to the bitlocker volume will spawn.
With a malicious unattend.xml and a modified Recovery directory planted at the root of the recovery partition, the next entry into WinRE via Shift + Restart spawns a shell with unrestricted access to the BitLocker-encrypted volume.
GreatXML operates as a persistence and data-access primitive after initial elevation, not as an initial access vector. An attacker who lands admin once can plant the files and walk away.
CVE-2026-50661 is a Windows BitLocker security feature bypass vulnerability that has been disclosed but not (yet) actively exploited.
Credential rotation, password resets, and loss of remote access do not remove the planted artifacts.
WinRE processes it natively during its boot sequence. The malicious version instructs WinRE to execute commands that spawn a shell environment with access to the BitLocker volume.
With the files planted and the machine in offline-scan WinRE state, the trigger is trivial and requires no credentials... On the WinRE boot, the offline-scan state causes WinRE to process the malicious unattend.xml. The windowsPE pass commands execute, the staging script runs, and a console shell spawns with access to the BitLocker-encrypted volume.
An unattend.xml placed at the recovery partition root in this state is processed during the WinRE boot sequence before normal security boundaries are enforced, before BitLocker prompts the user, and before any interactive logon occurs.
If not, the attacker uses their existing admin access to schedule an offline scan through Defender's interface or command-line tooling. The scan does not need to complete; scheduling it is sufficient to set the boot state flag that WinRE reads.
An unattend.xml placed at the recovery partition root in this state is processed during the WinRE boot sequence before normal security boundaries are enforced, before BitLocker prompts the user, and before any interactive logon occurs.
The result is a shell with unrestricted access to the BitLocker-protected volume, exposing all encrypted data without requiring the recovery key, PIN, or any credential.
Write unattend.xml + Recovery\WindowsRE to recovery partition... Persistent, hidden modification; no runtime activity... The planted files remain on the recovery partition.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.