GreatXML: Windows Zero-Day Turns Defender Offline Scan Into BitLocker Backdoor

Malware News
1

Introduction to Malware Binary Triage (IMBT) Course

Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.

Enroll Now and Save 10%: Coupon Code MWNEWS10

Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.

GreatXML: Windows Zero-Day Turns Defender Offline Scan Into BitLocker Backdoor

Key Findings

    • BitLocker bypass primitive abusing the state that Windows Recovery Environment enters after Microsoft Defender's offline scan has been used on a machine. No kernel bug, no memory corruption.
    • PoC published on GitHub on June 11, 2026 under the MSNightmare handle, with mirrors on git.projectnightcrawler[.]dev and git.churchofmalware[.]org. No coordinated disclosure, no CVE, no patch.
    • The chain is a planted unattend.xml plus a modified Recovery directory at the root of the recovery partition. The next entry into WinRE via Shift + Restart spawns a shell with unrestricted access to the BitLocker-encrypted volume. The trigger step requires no authentication, because Shift + Restart is available from the lock screen.
    • GreatXML is a post-compromise tool, not an initial access vector. Writing to the recovery partition root requires administrator rights. An attacker who lands admin once can plant the files silently. Credential rotation and loss of remote access do not remove them. The value is persistent data access that survives incident response.
    • Precondition: a Defender offline scan must have been initiated on the host at some prior point. The researcher acknowledges a no-prior-scan path is plausible but did not pursue it.
    • Cyderes Howler Cell verified the proof-of-concept on a fully patched Windows 11 machine.
    • Eighth tool from the Nightmare-Eclipse cluster in roughly ten weeks, and the second BitLocker bypass in the series after YellowKey.

Summary

On June 11, 2026, one day after publishing RoguePlanet, MSNightmare pushed another repository to GitHub. The exploit is named GreatXML, after the malicious Windows answer file at the center of the attack. Mirrors went up in parallel at git.projectnightcrawler[.]dev/NightmareEclipse and git.churchofmalware[.]org/Nightmare_Eclipse.

Article Link: GreatXML: Windows Zero-Day Turns Defender Offline Scan Into BitLocker Backdoor