Windows BitLocker Bypass and CTFMON Privilege Escalation | MSSP Advisory

Two new Windows zero-day vulnerabilities allow BitLocker drive encryption bypass (YellowKey) and privilege escalation through the Windows Collaborative Translation Framework CTFMON service (GreenPlasma). The researcher previously disclosed three Microsoft Defender zero-days and has published proof-of-concept code for both new vulnerabilities. Microsoft has not yet patched either vulnerability.

BitLocker bypass attacks your RMM encrypted endpoints and client workstations running full disk encryption that you told them would protect their data. The CTFMON privilege escalation gives attackers admin rights on any Windows machine they touch, which means every client endpoint you manage through remote access tools becomes a potential pivot point into their entire network.

📬