Nine Days Ago We Wrote About the BlueHammer Exploit Microsoft Patched on April 14. Since Then the Same Researcher Dropped Two More. RedSun Works on Fully Patched Windows Systems. UnDefend Disables Defender While Reporting Healthy to Management Consoles. All Three Are Under Active Exploitation.

THE EXPLOIT CHAIN

On April 15 we covered Microsoft's April Patch Tuesday and flagged CVE-2026-33825 as the zero-day that mattered most. A researcher using the handle Chaotic Eclipse (since linked to the GitHub alias Nightmare-Eclipse) had dropped working exploit code on April 3 in protest of what they described as Microsoft's disclosure timeline. Microsoft shipped the patch on April 14. The researcher kept going.

BlueHammer exploits a time-of-check to time-of-use race condition in the Windows Defender signature update process. When Defender rewrites a suspicious file during remediation, an attacker wins the race and redirects the privileged file operation to a location of their choosing. The result is an arbitrary read handle to the Security Account Manager database, which contains NTLM password hashes for every local account on the system. Extract the hashes, run pass-the-hash against local admin, spawn a SYSTEM shell. No kernel exploit required. No memory corruption. Just privileged file handling abuse.

RedSun does the same thing through a different Defender workflow. Nightmare-Eclipse released it shortly after the BlueHammer patch shipped. The exploit abuses an unvalidated write during cloud-file remediation. Defender's handling of cloud-tagged files can be manipulated to overwrite system paths with attacker-controlled content. The result is the same: SYSTEM-level privilege escalation from an unprivileged user context. RedSun works on Windows systems that have already installed the April 2026 Patch Tuesday updates. No CVE has been assigned.

UnDefend is the third piece. Where BlueHammer and RedSun escalate privileges, UnDefend blocks Defender's ability to defend. It tampers with the Defender signature update pipeline to prevent new threat intelligence from loading while continuing to report the endpoint as healthy to management consoles. An administrator watching a Defender for Endpoint dashboard sees green checkmarks. The endpoint is silently running on stale signatures. New malware detections do not fire because Defender does not have the signatures to fire them.

HOW THEY COMPOSE

The three exploits work better together than any of them work alone. Justin Howe, senior solutions architect at Vectra AI, described the composed attack chain in the Vectra writeup on April 21. "UnDefend silently degrades Defender's threat intelligence while reporting the endpoint as healthy to management consoles. RedSun escalates an unprivileged user to SYSTEM. And the now-degraded Defender is unable to detect the resulting foothold."

That sequence is the story. The attacker runs UnDefend first to blind the endpoint's own primary detection mechanism. Then RedSun to escalate. Then whatever post-exploitation tooling the attacker wants, free of the Defender detections that would normally fire. The administrator sees no alerts because UnDefend prevented them from generating. The endpoint reports healthy because UnDefend is specifically designed to defeat the monitoring surface that would otherwise catch it.

Howe made a related point that matters. "Defender is inside the trust boundary it is trying to enforce. When attackers manipulate its own privileged workflows, it becomes a delivery mechanism." The defense tool and the attack tool are the same process. When the defender has SYSTEM privileges to write files in protected locations (which it needs in order to remediate malware), and when that privileged write operation can be hijacked, the defender is no longer a defender. It is an attack primitive handed to whoever wins the race condition.

ACTIVE EXPLOITATION

Huntress Labs documented hands-on-keyboard exploitation of all three tools in a live intrusion investigation disclosed on April 20. The initial access was a compromised FortiGate SSL VPN account without multi-factor authentication. Once the attacker had network foothold, the exploitation chain was straightforward. Huntress observed the attackers staging artifacts in user-writable directories, including a user's Pictures folder and short-named subfolders under Downloads. The attackers manually ran reconnaissance commands (whoami /priv, cmdkey /list, net group) to map privileges before escalating.

BlueHammer has been in active use since at least April 10, four days before Microsoft's patch shipped. RedSun and UnDefend began appearing in the wild on April 16, two days after the Patch Tuesday release that addressed BlueHammer only. Huntress isolated the affected organization from the network to stop the intrusion before the attackers achieved their operational objectives.

Howe offered the most important operational observation in the Dark Reading coverage. "Every in-the-wild case Huntress has reported started with a compromised SSL VPN account without MFA. Once an attacker has any foothold, converting it to SYSTEM with RedSun is trivial." The hard part is initial access. The SYSTEM escalation is a script run.

WHAT THIS MEANS

We covered three related points across this month that all converge on this post. On April 15 we argued that AI-accelerated discovery was overwhelming the institutional patch pipeline, with Microsoft shipping its second-largest Patch Tuesday in history. On April 17 we covered NIST's public acknowledgment that it cannot keep up with CVE enrichment at current volumes. On April 20 we covered a Huntress case where an AI coding agent masked cryptominer symptoms during user-led incident response. The Nightmare-Eclipse situation is the same dynamic in a different form. A single researcher operating alone has now dropped three working exploits against Windows Defender in less than two weeks. Microsoft patched the first in eleven days. Two remain unpatched after eight additional days. The researcher can develop exploits faster than Microsoft can ship responses.

This is not a criticism of Microsoft specifically. Any vendor operating at Microsoft's scale faces the same structural challenge. Sophisticated exploit development at the hands of individual researchers, AI-assisted vulnerability discovery, and public PoC release as a pressure tactic all compress vendor response windows in ways the traditional patch cycle cannot absorb. The window between disclosure and patch has become the window between disclosure and widespread exploitation. In the case of RedSun and UnDefend, that window remains open. And the research shows that when researchers lose patience with vendor responsiveness, they go public. When they go public, working exploit code circulates. When working exploit code circulates, it gets used against real environments within days.

INDICATORS AND TECHNICAL DETAILS

WHAT ORGANIZATIONS SHOULD DO