Key Takeaways
- Threat actors are using three public proof‑of‑concept (PoC) exploits—BlueHammer, RedSun, and UnDefend—to hijack Microsoft Defender’s privileged operations and turn the antivirus into a weapon against the systems it protects.
- BlueHammer and RedSun grant SYSTEM‑level access by exploiting race conditions in Defender’s file‑remediation workflow; neither requires a kernel exploit or memory corruption.
- UnDefend does not provide elevated privileges itself but, once SYSTEM access is obtained, it silently corrupts Defender’s signature‑update pipeline to degrade threat detection while reporting a healthy status to management consoles.
- All three exploits target fully patched Windows 10, Windows 11, Windows Server 2019 and later releases; only BlueHammer is mitigated by the April 2026 security update for CVE‑2026‑33825. RedSun and UnDefend currently lack assigned CVEs.
- Attackers typically gain initial foothold via compromised SSL‑VPN accounts lacking multifactor authentication (MFA); once inside, privilege escalation with RedSun is described as “trivial.”
- Effective defenses include applying Microsoft’s April 2026 patch, verifying Defender’s antimalware platform version (v4.18.26050.3011 or newer), enforcing MFA on all remote‑access vectors, blocking execution from user‑writable folders (Downloads, Pictures, Temp), and monitoring the hash of TieringEngineService.exe for unexpected changes.
- Detection strategies should be placed outside the endpoint’s trust boundary (e.g., network‑based or cloud‑security layers) because the subverted Defender can falsify its own health reports.
- The exploits highlight systemic weaknesses in Defender’s privileged file‑handling—particularly path validation, race‑condition safeguards, and over‑trust in internal workflows—rather than isolated bugs.
Threat Landscape Overview
Security researchers have observed a coordinated wave of attacks in which adversaries repurpose Microsoft Defender’s own defensive mechanisms to achieve privilege escalation and undermine endpoint protection. The campaign leverages three publicly released proof‑of‑concept exploits—BlueHammer, RedSun, and UnDefend—originally shared by a researcher using the alias “Nightmare‑Eclipse.” While the exploits differ in technical detail, each abuses a trusted Defender process to execute attacker‑controlled code with SYSTEM privileges or to silently degrade Defender’s ability to stay current with threat intelligence. The activity has been deemed “targeted, hands‑on” by firms such as Huntress Labs, indicating that attackers are manually executing privilege‑enumeration commands before attempting exploitation, rather than relying on fully automated malware.
Exploit Details: BlueHammer
BlueHammer targets CVE‑2026‑33825, a time‑of‑check to time‑of‑use (TOCTOU) flaw in Windows Defender’s signature‑update workflow. When Defender detects a suspicious file, it initiates a remediation routine that rewrites the file to a safe location. BlueHammer wins the race between Defender’s check and the actual rewrite, redirecting the operation to a location chosen by the attacker. Because the rewrite runs under Defender’s privileged context, the attacker gains SYSTEM‑level execution without needing a kernel exploit or memory corruption. Microsoft issued a patch for this vulnerability in its April 2026 security update, which mitigates BlueHammer but leaves the other two PoCs unaffected.
Exploit Details: RedSun
RedSun operates on a similar principle but focuses on the TieringEngineService.exe process, a Defender background component responsible for classifying and prioritizing detected files and threats. An attacker need only place an embedded EICAR test string—a benign marker widely used to verify antivirus functionality—where Defender will encounter it. Upon detection, Defender triggers a remediation cycle; RedSun wins the ensuing race condition, causing the Cloud Files Infrastructure to execute an attacker‑placed binary with SYSTEM privileges. Notably, RedSun functions against fully patched Windows 10, Windows 11, Windows Server 2019 and later systems, even those that have received the latest Patch Tuesday updates, indicating that the underlying flaw remains unaddressed by current Microsoft patches.
Exploit Details: UnDefend
Unlike BlueHammer and RedSun, UnDefend does not directly elevate privileges. Instead, it is designed to be run after an attacker has already obtained SYSTEM access (via either BlueHammer or RedSun). When launched as a child of cmd.exe under Explorer with the “‑aggressive” flag, UnDefend subtly interferes with Defender’s signature‑update pipeline. It feeds false health data to the management console, making the endpoint appear protected while simultaneously starving Defender of current threat‑intelligence updates. Over time, the antivirus becomes progressively less capable of detecting new malware, yet no obvious failure alerts are raised, allowing the degradation to go unnoticed.
Observed In‑The‑Wild Activity
Huntress Labs reported observing targeted intrusions that employed the three exploits in a deliberate, manual fashion. Attackers first enumerated privileges on compromised hosts, then staged binaries in low‑noise user directories such as the Pictures folder and two‑letter subfolders inside Downloads. By using original proof‑of‑concept filenames or lightly obfuscated variants, they reduced detection rates on multi‑engine scanners like VirusTotal. Picus Security’s lead researcher, Hüseyin Can Yüceel, noted that the recent activity shows minimal modification of the public PoCs, underscoring how moderately skilled adversaries can reliably escalate privileges or weaken defenses once they achieve any local foothold.
Underlying Weaknesses in Defender
Justin Howe, senior solutions architect at Vectra.ai, characterizes the three exploits as abuse of distinct but related gaps in how Defender performs privileged file operations without validating its own I/O paths at the moment of execution. BlueHammer leverages a VSS snapshot mount during the signature‑update workflow; RedSun exploits an unvalidated write during cloud‑file remediation; UnDefend tampers with the signature‑update pipeline while reporting a healthy status. Collectively, these flaws reveal that Defender operates inside the very trust boundary it is meant to protect. When attackers manipulate Defender’s privileged workflows, the security product becomes a delivery mechanism for malicious code rather than a barrier against it.
Challenges of Initial Access
Researchers concur that the most difficult step for attackers is obtaining initial access to a target system. Huntress’s investigations indicated that every observed intrusion began with a compromised SSL‑VPN account lacking multifactor authentication (MFA). Once an attacker gains any foothold—even a low‑privilege user session—executing RedSun to achieve SYSTEM access is described as “trivial.” Consequently, defenders should prioritize hardening remote‑access gateways: enforce MFA on all VPN and remote‑access services, restrict execution from user‑writable directories (Downloads, Pictures, Temp), and employ application‑control policies that block unauthorized binaries from those locations.
Recommendations for Defense
Organizations should take a layered approach to mitigate the risk posed by these exploits. First, apply Microsoft’s April 2026 security update to close the BlueHammer (CVE‑2026‑33825) vector and verify that the Antimalware Platform version is at least v4.18.26050.3011, as older versions may still be vulnerable to RedSun and UnDefend. Second, hunt for anomalies: baseline the cryptographic hash of TieringEngineService.exe and alert on any deviation, which would indicate tampering by RedSun. Third, deploy detection mechanisms that operate outside the endpoint’s trust boundary—such as network‑traffic analysis, cloud‑based security platforms, or host‑based intrusion‑detection sensors that do not rely on Defender’s health reporting. Finally, enforce strict least‑privilege principles, limit lateral movement, and continuously educate users about phishing and credential‑theft tactics that often precede VPN compromise.
Conclusion
The trio of PoC exploits illustrates how trusted security tools can be subverted when internal validation and path‑checking mechanisms are insufficient. While Microsoft’s patch resolves one of the flaws, the remaining vulnerabilities expose a broader systemic issue: Defender’s privileged file‑handling processes implicitly trust user‑supplied data and lack robust race‑condition safeguards. Until these design gaps are addressed, organizations must combine timely patching, rigorous access controls, execution‑restriction policies, and external monitoring to prevent attackers from turning the very defender meant to protect them into a conduit for compromise.