← Cybersecurity Today
Cybersecurity Today
Windows 11 BitLocker Zero-Day, TeamPCP Malware Leak, Iran Gas Station Hacks | Cybersecurity Today
00:13:10
Loading summary
Transcript3 lines
- [00:00]
A
Cybersecurity Today we'd like to thank Material Security for sponsoring this podcast. Material Security provides faster, more complete detection and response for email identity and data threats inside Google Workspace and Microsoft 365. You can contact them at Material Security
- [00:24]
B
A0 Day Defeats Default Windows 11 BitLocker Encryption Team PCP Open Sources ITS Malware Tool Tools Fast 16 Malware designed to sabotage nuclear explosion experiments and Iran suspected in US Gas station hacks. This is Cybersecurity Today, and I'm your host, David Shipley. Let's get started. A new zero day exploit completely defeats default BitLocker encryption on Windows 11, giving anyone with physical access to the device free full access to the encrypted drive in seconds, according to Ars Technica. The exploit is called Yellow Key. It was published last week by a researcher using the alias Nightmare Eclipse. Multiple independent security researchers, including Kevin Beaumont and Will Dorman at Taros Labs, have confirmed it works. Here's what the attack looks like. You plug in a USB drive containing a specially crafted folder into the target device. You boot the machine, hold down the key combination, and trigger the Windows recovery environment. Instead of being prompted for a BitLocker recovery key, which is how the system is supposed to behave, you get a command prompt with full, unencrypted access to the entire drive. The exploit only works against the default BitLocker configuration in Windows 11, what's called TPM only mode. In that mode, the encryption key is stored in the device's Trusted Platform module, and the drive is automatically unlocked when the machine boots. There is no second factor required. The TPM Only configuration has been criticized by security professionals for years, but it remains the default one on fresh Windows 11 installs. Researchers haven't yet nailed down exactly how Yellow Key works. The leading theory from Dorman's analysis is that it abuses a feature called Transactional ntfs, which lets Windows group file operations into atomic transactions. The crafted folder on the USB drive somehow manipulates the contents of a completely separate volume. When Windows replays the transaction, the net result is that the recovery environment launches into a command prompt with the BitLocker volume already unlocked. Microsoft declined to answer specific questions and said only that it was investigating the issue. Bitlocker is mandatory for many government contractors and for any organization handling regulated data on Windows laptops. A lost laptop or stolen Device running Default BitLocker can no longer be assumed safe until a patch arrives. The workaround is to enable BitLocker's pre boot authentication mode, which requires a PIN before the TPM will release the decryption encryption key. That is not the default, but it's a configuration most security teams should already be running on high risk endpoints. Team pcp, the group behind a series of devastating software supply chain attacks throughout 2026, has open sourced the code for its offensive framework on GitHub. The release dramatically lowers the barrier to entry for other actors to copy the techniques that until now were only seen in Team PCP's own massively disruptive campaigns. According to a detailed analysis published by Datadog Security Labs, the Repository appeared on GitHub on May 12th. The README simply said Love Team PCP and change keys and C2 as needed. GitHub removed the repository shortly after publication, but not in time to prevent multiple forks. Team PCP is the group behind the Trivi and Checkmark hacks in March, as well as the Light LLM PYPI poisoning and the Tanstack and UiPath npm compromises. Datadog's analysis has found that the repository contains a production grade offensive framework, accounting for 19 of the 22 distinct techniques previously attributed to Team PCP across those prior campaigns. By open sourcing the framework, Team PCP will be able to obfuscate its activities further even if it continues to use it or if it's moving to a brand new framework. It'll also be able to hide its patterns from security researchers while also keeping everyone busy defending against attacks using the now open sourced tool. The released framework specifically targets AI coding assistant configuration files as a persistence mechanism. When it compromises a GitHub repository, it pushes malicious files that trigger automatic execution. When a developer opens the repository in VS code or starts a new session in clone code, a developer who clones a poisoned repository to investigate it executes the payload without any further interaction. When the framework steals a GitHub token, it installs a monitoring daemon that polls the token's validity. Will Once a minute if the daemon detects that the token has been revoked, it executes a delete command against the user's home directory. The commit message used during the exfiltration spells this out. If you revoke this token, it will wipe the computer of the owner. If you discover the framework on a system, do not revoke the GitHub token first. Disable the monitoring daemon first. The Datadog analysis includes specific commands to do that. According to the Hacker News security firm Auk Security identified four malicious NPM packages last week published by a single actor. One of them contains a near verbatim clone of the Shai Hulud worm code lifted entirely from the Team PCP release with only the command and control server changed. The three packages from the same actor deliver different payloads including a Go based DDoS botnet and two credentials dealers we can all expect more chaos from Team PCP's latest move a new analysis of the Fast 16 malware confirms what the tool was actually designed to do, and the answer is more specific and more disturbing than anyone publicly knew. We first covered Fast 16 in our April 27 episode, Sentinel One. Researchers had documented it as the earliest known industrial sabotage framework, predating stuxnet by roughly two years with components dating back to 2005. It surfaced in the 2017 Shadow Brokers leak of tools attributed to the Equation Group, a state sponsored hacking team widely believed to be operated by the US National Security Agency. What SentinelOne couldn't say with confidence at the time was what Fast 16 was actually designed to sabotage, according to the Hacker News. That question has been answered. Researchers at Symantec and Carbon Black have completed a detailed analysis of the malware's hook engine and concluded that Fast 16 was designed to corrupt nuclear weapons design simulations. Specifically, the malware targets LSDyna and Autodin, two industrial physics simulators used to model material behavior under under extreme conditions, including high explosive detonations. Fast 16's tampering only activates when the simulation involves a material with a density above 30 grams per cubic centimeter. That's the density uranium reaches under the shock compression of an implosion device. Anything less than that, the malware leaves the experiment alone. Vikram Thakrur, technical director at Symantec, described the level of domain expertise required to build this tool in 2005 as mind blowing. US officials suspect Iranian hackers are behind a series of breaches of fuel monitoring systems at gas stations in multiple American states. The affected systems are called automatic tank gauges, or ATGs. They sit at gas stations and monitor the fuel level in underground storage tanks. According to reporting from cnn, the ones that were compromised were sitting on the public Internet with no password protection. In some of the breaches, the attackers were able to manipulate the level readings the systems displayed, though not the actual fuel levels in the tanks. So far, no physical damage or harm has been reported from these hacks. The safety concern, though, is real. If an attacker can falsify the readings, a real gas leak from a tank could go undetected. Multiple US Officials briefed on the investigation pointed to Iran as the top suspect. Iran has a documented history of targeting ATG Systems. Specifically, in 2015, security firm Trend Micro put mock ATG systems online as a honeypot and a pro Iran group was among the quickest to attack it. A 2021 Sky News report cited Iranian Revolutionary Guard Corps documents that explicitly singled out ATGS as targets for disruptions of U.S. gas stations. Since the U.S. israeli war with Iran began in late February, hackers linked to Tehran have been blamed for disruptions at multiple U.S. oil, gas and water facilities, shipping delays at medical device manufacturer Stryker, and the leak of FBI Director Kash Patel's personal emails. Researchers tracking Iran linked groups described the country's cyber operations as accelerating with faster iteration and likely AI assisted scaling for reconnaissance and phishing. The harder question underneath all of this is one for US critical infrastructure operators. The ATGs that got compromised were sitting on the public Internet without passwords. Researchers have been warning about exactly this exposure for more than a decade. The story is less about Iran's capabilities than about how much American critical infrastructure remains accessible to anyone willing to go scan for it. If your organization operates ICS or OT equipment with a public facing IP address, the action is the same one it's been for a decade. Inventory what you have on the Internet. Take off whatever doesn't need to be there. Put authentication in front of whatever's left. That's cybersecurity today for Wednesday, May 20, 2026. I'll be speaking and participating at the Canadian Cyber Threat Exchange or CCTX annual symposium today in Toronto about AI's impact on the human side of cybersecurity. If you're there, please do stop by and say hi. I love meeting listeners when I'm on the road. Feel free to leave a comment under the YouTube video or to drop by technewsday.com or CA and send us a note thank you to everyone who's left a rating or or review on their favorite podcast platform. It really does help us reach more people and it makes our day. Jim Love will be back on the news desk on Friday.
- [11:59]
A
Here's a question worth asking. What happens after a phishing email slips past your filters? Most email security tools only guard the front door, but attackers are already inside. Material security is different. It's a unified detection and response platform, purpose built for Google Workspace and Microsoft 365, protecting email files and accounts all in one place. We're talking automated phishing, remediation, account takeover containment and sensitive data protection without alert fatigue. Find out why companies like Figma, Reddit and Lyft trust material to stop the threats. Other tools Ms. See workspace security in action at Material Security. That's Material Security. And if you do contact them. Take a second and say thanks for sponsoring cybersecurity today.