Loading story…
Microsoft provided the FBI with BitLocker recovery keys to decrypt data on three seized laptops as part of a federal investigation in Guam into alleged fraud tied to the Pandemic Unemployment Assistance program, according to reporting cited by both TechCrunch and DataBreaches.net (via Forbes). The reporting highlights that BitLocker full-disk encryption is enabled by default on many modern Windows systems and that recovery keys may be uploaded to Microsoft’s cloud by default or by user choice, enabling Microsoft to produce those keys in response to lawful process.
The case has been framed as a broader privacy and security concern: cloud-stored recovery keys can be obtained via subpoenas/warrants and could also become a target if attackers compromise cloud infrastructure. TechCrunch cited cryptography expert Matthew Green warning that a breach of Microsoft’s cloud could expose recovery keys (though physical access to the encrypted drives would still be required to use them), and reported Microsoft told Forbes it receives an average of roughly 20 law-enforcement requests per year for BitLocker recovery keys.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
In statements cited across follow-on coverage, Microsoft said it may provide BitLocker recovery keys to authorities when presented with valid legal process, but only when customers have stored those keys in Microsoft's cloud. The company emphasized that users can choose other key-management methods that leave Microsoft unable to assist.
Forbes published the first widely cited report that Microsoft had provided BitLocker recovery keys to the FBI in the Guam fraud investigation. The report also said Microsoft told Forbes it receives about 20 such law-enforcement requests per year on average.
A 2025 court document cited in later reporting said an ICE forensic expert stated the agency lacked tools to defeat BitLocker encryption without the recovery key. The filing underscored that access to Microsoft-held recovery keys was operationally significant to the investigation.
Microsoft complied with the warrant and provided cloud-stored BitLocker recovery keys for the three laptops, allowing federal investigators to unlock the encrypted drives. Reports describe this as the first publicly known case in which Microsoft disclosed BitLocker keys that directly enabled law enforcement access to device data.
In early 2025, the FBI served Microsoft with a search warrant seeking BitLocker recovery keys for three laptops tied to a Guam investigation into alleged COVID-19 Pandemic Unemployment Assistance fraud. Investigators needed the keys because the seized devices' drives were protected by BitLocker full-disk encryption.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
12 references tracked. Mallory keeps watching after this page renders.
zdnet.com
Open sourcecyberscoop.com
Open sourcezdnet.com
Open sourcescworld.com
Open sourcego.theregister.com
Open sourcetechcrunch.com
Open sourcedatabreaches.net
Open sourceforbes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has published **CVE-2026-50661**, a **Windows BitLocker** security feature bypass caused by **`CWE-693: Protection Mechanism Failure`**. The flaw allows an unauthorized attacker with **physical access** to bypass BitLocker protections on affected Windows systems, including multiple supported builds of **Windows 10, Windows 11, Windows Server 2016, 2019, 2022, and 2025**, before Microsoft’s listed fixed versions. Microsoft scored the issue **CVSS 6.1 (Medium)** and released vendor advisory and patch information through MSRC. If exploited, the weakness could let an attacker recover the **Volume Master Key**, decrypt the full physical volume, and access sensitive data such as user files, system configuration, and active session tokens. The same access could enable offline tampering, including modifying binaries, changing registry hives, or planting persistent malware such as **bootkits** or malicious drivers before the device is returned to service. Reported mitigations include applying Microsoft’s updates, requiring a **pre-boot PIN** for BitLocker, and disabling the Windows Recovery Environment with: ```bash reagentc /disable ```
Jul 15, 2026
Researchers detailed multiple attack paths that can defeat or weaken Microsoft BitLocker on systems using **TPM-only** unlock, showing that physical access remains enough to recover disk encryption keys or bypass pre-boot protections in common configurations. Neodyme revisited the **Bitpixie** technique tied to `CVE-2023-21563`, describing how attackers can downgrade the Windows Boot Manager, abuse a PXE soft-reboot path, and recover the Volume Master Key from memory without the user’s password. A follow-up analysis said Microsoft has struggled to fully close downgrade paths because Secure Boot revocation capacity is limited, older Microsoft-signed bootloaders remain broadly trusted, and stricter PCR bindings have caused recovery and compatibility problems in the field. Separate research from MDSec showed that Dell UEFI firmware can be modified offline at the SPI flash level to disable pre-boot DMA protections while leaving BIOS settings appearing unchanged, enabling follow-on DMA attacks against Windows 11 devices protected by TPM-only BitLocker and, in some cases, privilege escalation even on TPM+PIN systems when the PIN is known. A public GitHub project compiling BitLocker attack techniques further underscored the breadth of the issue, cataloging hardware and software methods ranging from TPM bus sniffing and fTPM glitching to bootloader, WinRE, and recovery-environment flaws across numerous CVEs. Across the disclosures, the consistent mitigation theme was to avoid relying on TPM-only unlock where possible, apply Microsoft’s Secure Boot certificate updates such as **KB5025885**, and require a **pre-boot PIN** to materially raise the bar for physical attackers.
Jul 24, 2026
An anonymous researcher using the aliases **Nightmare-Eclipse** and **Chaotic Eclipse** publicly released details for two alleged Microsoft zero-days, **YellowKey** and **GreenPlasma**, adding to a string of earlier disclosures that included **BlueHammer**, **RedSun**, and **UnDefend**. YellowKey is described as a **BitLocker bypass** that requires physical access and a USB device, allowing an attacker to reboot into the Windows Recovery Environment (**WinRE**) and gain access to an encrypted drive; reporting said the technique was independently reproduced. Public materials claim the issue affects **Windows 11** and **Windows Server 2022/2025**, while **Windows 10** is not affected. GreenPlasma was disclosed as a **local privilege escalation** flaw that allegedly abuses `CTFMon` and Windows Object Manager section handling to obtain **SYSTEM** privileges, although reports said the released code still triggers a UAC prompt under default settings. Security experts warned that YellowKey could sharply raise the impact of laptop theft because BitLocker is often the final safeguard for stolen Windows devices; suggested mitigations include enabling a **BitLocker PIN** and locking firmware settings with a **BIOS password**, while no practical workaround for GreenPlasma was identified beyond a future vendor patch. Microsoft had not publicly responded to the two disclosures at the time of reporting, and prior proof-of-concept releases from the same researcher were reportedly later used in real-world attacks.
Jun 29, 2026