When the Defender Becomes the Door: Inside the BlueHammer, RedSun, and UnDefend Triple Zero-Day Crisis

In April 2026, Microsoft Defender — the endpoint protection trusted by over 1.4 billion devices — became the very tool attackers used to compromise systems. Three zero-days from a frustrated researcher turned a security cornerstone into an attack vector. Here’s the full anatomy of the BlueHammer, RedSun, and UnDefend crisis.

The Timeline: How It Unfolded

The events of April 2026 unfolded with unusual speed:

• April 3–16: Security researcher “Chaotic Eclipse” (also known as “Nightmare-Eclipse”) publicly disclosed three zero-day vulnerabilities in Microsoft Defender after expressing frustration with Microsoft’s handling of the disclosure process.
• April 10: Huntress Labs confirmed real-world exploitation of the first vulnerability, BlueHammer (CVE-2026-33825), in active intrusions.
• April 14: Microsoft’s Patch Tuesday addressed BlueHammer with CVE-2026-33825, but left two critical flaws unpatched — see our April Patch Tuesday breakdown for the full picture.
• April 16: Chaotic Eclipse published proof-of-concept exploit code for the remaining two vulnerabilities — RedSun and UnDefend. Huntress confirmed exploitation of all three on the same day.
• April 30: CISA ordered federal agencies to patch CVE-2026-32202 (a related Windows zero-click flaw) by May 12, adding urgency to the broader Windows security landscape.

Breaking Down the Triple Threat

BlueHammer (CVE-2026-33825) — The SAM Database Heist

BlueHammer exploits a time-of-check to time-of-use (TOCTOU) race condition and path confusion flaw within Windows Defender’s signature update workflow. The attack is deceptively elegant:

1. The attacker uses Windows opportunistic file locks (oplocks) to suspend Defender’s scanning operation.
2. They trigger a Defender signature update, which causes Defender — running with SYSTEM privileges — to copy files from a directory the attacker controls.
3. By exploiting a path confusion vulnerability, the attacker tricks Defender into copying the Security Account Manager (SAM) database to an accessible output directory.
4. The result? Complete credential theft, enabling lateral movement across the network using stolen NTLM hashes.

BlueHammer was patched in April’s Patch Tuesday (CVE-2026-33825), but not before active exploitation was observed in the wild starting April 10 — four days before the fix arrived.

RedSun — SYSTEM-Level File Overwrite

RedSun is arguably the most dangerous of the three because it remains unpatched as of May 4, 2026. It exploits how Microsoft Defender handles cloud-tagged files by combining several legitimate Windows features into a devastating attack chain:

• Cloud Files API manipulation: Defender treats cloud-tagged files differently, triggering special handling.
• Opportunistic locks (oplocks): Used to create race conditions in Defender’s file processing pipeline.
• Volume Shadow Copy coordination: Exploits the VSS service to access protected file copies.
• Directory junctions: Creates file system redirection that causes Defender, running as SYSTEM, to overwrite protected system files.

The net effect: an attacker with local access can execute arbitrary code with SYSTEM-level privileges on fully patched systems. This is a complete privilege escalation chain that bypasses every standard access control.

No CVE has been assigned to RedSun yet. No official CVSS rating exists. No patch timeline has been communicated by Microsoft.

UnDefend — Silencing the Sentinel

UnDefend targets Microsoft Defender’s update mechanism, allowing a local user to block or disrupt definition updates. While it doesn’t provide direct code execution, its strategic value is significant:

• Blocks Defender’s ability to download new malware signatures
• Creates a denial-of-service condition against endpoint detection
• When combined with BlueHammer and RedSun, it creates a multi-stage attack where the defender is first neutralized, then the system is compromised
• Reduces detection coverage over time, making existing malware harder to catch

Like RedSun, UnDefend has no CVE assignment and no available patch as of this writing.

The Attack Chain in Practice

This chain represents a textbook MITRE ATT&CK progression, with each vulnerability covering a different phase of the attack lifecycle.

The Disclosure Problem

The story behind these disclosures raises serious questions about responsible disclosure practices:

• Chaotic Eclipse published full proof-of-concept exploit code before patches were available.
• The researcher cited frustration with Microsoft’s communication and handling of the initial report.
• Within 48 hours of public PoC release, active exploitation was confirmed in the wild.
• The gap between disclosure and patching for RedSun and UnDefend has now exceeded two weeks with no resolution in sight.

While the ethics of full public disclosure without vendor coordination remain debated, the outcome is unambiguous: threat actors weaponized the exploits almost immediately, and defenders are left without patches for two of three vulnerabilities.

Immediate Defensive Actions

Here’s what security teams should do right now:

Patch Status Verification

• Verify all systems have applied the April 2026 Patch Tuesday updates (addresses BlueHammer/CVE-2026-33825).
• Check Defender Anti-malware Platform version — updated platforms include the BlueHammer fix.
• Monitor Microsoft Security Response Center (MSRC) for updates on RedSun and UnDefend.

Detection & Monitoring

• Monitor for anomalous Microsoft Defender cleanup activity — unusual file deletions or copies from system directories.
• Watch for unexpected privilege escalation to SYSTEM from standard user contexts.
• Detect unauthorized modification of protected system files, especially in %windir%System32.
• Monitor for Defender definition update failures or unusual gaps in signature coverage.
• Track use of opportunistic locks (oplocks) and directory junctions in non-standard contexts.

Compensating Controls

• Deploy behavioral analytics that detect exploitation behavior rather than relying solely on exploit signatures.
• Implement Zero Trust principles — even SYSTEM accounts shouldn’t have unfettered access.
• Restrict local administrator rights to reduce the initial access surface for these exploits.
• Consider supplementary endpoint protection to provide defense-in-depth while Defender is partially degraded.
• Enable Credential Guard to protect against SAM database extraction techniques.

The Bigger Picture

The BlueHammer/RedSun/UnDefend incident highlights several uncomfortable truths about modern cybersecurity:

• Security tools are targets: When your antivirus runs as SYSTEM, it becomes the highest-value privilege escalation target on the system.
• Disclosure gaps are weaponized: The time between public disclosure and patching is an active hunting window for threat actors.
• Patch management is reactive: Organizations that only apply monthly patches are vulnerable for weeks between disclosure and Patch Tuesday.
• Defense-in-depth matters: Relying on a single security control — even one built into the OS — creates single points of failure.

This is consistent with the broader trend of attackers targeting security infrastructure itself, a pattern we’ve seen with vulnerabilities in firewalls, EDR solutions, and now the most widely deployed antivirus in the world.

What to Watch Next

• RedSun and UnDefend patches: Microsoft has not provided a timeline. Expect an out-of-band update if exploitation escalates.
• CVE assignments: Without CVEs, vulnerability management tools can’t track or prioritize these flaws. Pressure on Microsoft to assign identifiers is growing.
• Broader threat actor adoption: Currently exploitation appears limited, but the public availability of PoC code means this could change rapidly.
• Regulatory response: CISA’s involvement with related Windows zero-days suggests increasing government scrutiny of Microsoft’s patch cadence.

Conclusion

The BlueHammer, RedSun, and UnDefend triple zero-day is a wake-up call for organizations that treat their built-in antivirus as a security silver bullet. When the defender becomes the door, the only path forward is layered defenses, continuous monitoring, and a healthy skepticism toward any single security control — no matter how widely deployed.

Patch BlueHammer immediately. Monitor for RedSun and UnDefend. And remember: in 2026, the most dangerous vulnerabilities aren’t in the applications you build — they’re in the tools you trust to protect them.

FAQ

What is BlueHammer (CVE-2026-33825)?

A TOCTOU race condition plus path confusion flaw in Microsoft Defender’s signature update workflow. It tricks SYSTEM-privileged Defender into copying the SAM database to an attacker-accessible location, enabling total credential theft. It was actively exploited from April 10, 2026 and patched on April 14.

Are RedSun and UnDefend patched?

No. As of May 4, 2026, both remain unpatched with no CVE assignments and no communicated timeline from Microsoft. RedSun enables SYSTEM-level arbitrary code execution; UnDefend blocks Defender definition updates.

How do the three Defender zero-days work together?

Typical chain: initial access via stolen VPN credentials → privilege escalation via BlueHammer or RedSun → SAM extraction for lateral movement → UnDefend to blind detection → persistence. Each flaw covers a different MITRE ATT&CK phase.

How do I detect BlueHammer or RedSun exploitation?

Watch for anomalous Defender cleanup/copy activity from system directories, SYSTEM escalations from standard user contexts, unexpected changes in System32, Defender definition-update failures, and non-standard oplock or directory-junction usage.

References

• Huntress Labs — Threat Research
• Microsoft Security Response Center (MSRC)
• CISA KEV Catalog
• Hmmnm — Microsoft April 2026 Patch Tuesday Analysis

Related Reading

Part of our Cyber Threat Intelligence & CVE Analysis: The Complete Guide series.

n

n
• Cyber Threat Intelligence & CVE Analysis: The Complete Guide
• CVE-2026-41940: cPanel Authentication Bypass — What Happened and How to Respond
• CVE-2026-2256 to SGLang RCE: The Week AI Infrastructure Went Under Siege
• The Zero-Day Surge of 2026: Critical Vulnerabilities Every Defender Must Know
• The AI Inversion: 6 Real Incidents That Redefined Cybersecurity in 2026
• Education Sector Cybersecurity Crisis: Canvas Breach and Carmen Shutdown Shake Academia
• Cybersecurity Threat Briefing: Zero-Days, AI Supply Chain Attacks, and Next-Gen Banking Trojans (May 2026)