BlueHammer Windows Zero-Day Local Privilege Escalation to SYSTEM via TOCTOU Race Condition and Path Confusion — Threadlinqs Intelligence
As of 2026-05-30, BlueHammer Windows Zero-Day Local Privilege Escalation to SYSTEM via TOCTOU Race Condition and Path Confusion is a high-severity zero day threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-0329 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: ZERO_DAY
Attribution: N/A · UNKNOWN
BlueHammer is an unpatched Windows local privilege escalation zero-day that exploits a TOCTOU race condition in Windows Defender's signature update process combined with path confusion via junction
BlueHammer is a sophisticated local privilege escalation (LPE) zero-day exploit targeting the Windows Defender signature update mechanism. The vulnerability chains a Time-of-Check-Time-of-Use (TOCTOU) race condition with path confusion to achieve SYSTEM-level access on Windows systems.
The exploit operates through six coordinated stages. First, it retrieves a legitimate Windows Defender signature update from Microsoft's official URL (go.microsoft.com). Second, it drops a reversed EICAR test file and monitors Volume Shadow Copy snapshots via NtQueryDirectoryObject. Third, it registers a Cloud Files sync root with a callback that identifies the Windows Defender process by PID using the CfRegisterSyncRoot and CfConnectSyncRoot APIs. Fourth, it takes a batch oplock on the mpasbase.vdm file and swaps directory junctions to \BaseNamedObjects\Restricted using NtCreateSymbolicLinkObject. Fifth, it triggers the update process by invoking Proc42_ServerMpUpdateEngineSignature via the Windows Defender RPC interface. Finally, it exploits the resulting race condition to access the Security Account Manager (SAM) database, extracts password hashes using offline registry parsing (OROpenHive), modifies the user password, creates a temporary SYSTEM service for privilege escalation, and then restores the original NT hashes to avoid detection.
SAM hash decryption supports both AES (Revision 3) and RC4 (Revision 2) for SAM key decryption, with AES or RC4 plus DES-ECB for NT hash decryption. The boot key is extracted from the live SYSTEM registry class names with permutation.
The exploit codebase is structured across multiple modules: update.cpp (PE resource parsing, cabinet extraction via FDI), vss.cpp (EICAR drops, VSS monitoring), cloudfiles.cpp (Cloud Files sync root registration with batch oplock), race.cpp (junction swapping, symbolic link creation), sam.cpp (offline SAM parsing via OROpenHive), escalate.cpp (Net API password changes, service creation), and main.cpp (stage orchestration). The PoC dynamically loads cldapi.dll, offreg.dll, and samlib.dll at runtime.
The exploit has been confirmed functional on Windows 11 25H2 by security researcher Will Dormann, principal vulnerability analyst at Tharros. Testing indicates it is non-functional on Windows 11 22H2, 23H2, and 24H2. On Windows Server platforms, the exploit is limited to escalating from non-admin to elevated administrator rather than full SYSTEM access. The PoC contains intentional bugs that reduce reliability but is acknowledged as operationally useful.
The researcher, operating under the aliases Chaotic Eclipse and Nightmare-Eclipse, published the exploit on GitHub on April 3, 2026 after frustrations with Microsoft's Security Response Center (MSRC) handling of the vulnerability disclosure. MSRC reportedly required a video demonstration of the exploit as part of the submission process, which the researcher viewed as an unreasonable friction point. The researcher stated: 'I was not bluffing Microsoft, and I'm doing it again' and 'I'm not explaining how this works; y'all geniuses can figure it out.'
The exploit exhibits notable operational security characteristics: it makes only a single network connection to a legitimate Microsoft URL, deletes the temporary SYSTEM service after exploitation, and restores original NT hashes to minimize forensic evidence. These anti-forensic features increase the risk if adopted by ransomware groups or advanced threat actors for post-compromise privilege escalation.
Weaknesses (CWE)
CWE-367, CWE-427
Target sectors: government, financial, healthcare, critical-infrastructure, technology, defense, energy
Target regions: Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
ZERO_DAY, HIGH, threat intelligence, cybersecurity, T1068, T1003, T1562, T1569, T1543, T1574, T1106, T1070, T1553, T1082