# BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-Day Remote Code Execution

> Two distinct threat actor clusters — BlueHammer (China-nexus espionage) and RedSun (Iran-nexus, IRGC-adjacent) — are actively weaponizing CVE-2026-33825, a critical RCE vulnerability in the Microsoft Defender MpEngine scan engine. Crafted archives and script payloads trigger arbitrary SYSTEM-level code execution during on-access scanning, converting the endpoint's own AV into an initial access vector. Microsoft confirmed in-the-wild exploitation on 2026-04-15; CISA added the CVE to its Known Exploited Vulnerabilities catalog on 2026-04-16.

- **Published:** 2026-04-16T12:00:00Z
- **Last reviewed:** 2026-04-16T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0382
- **ID:** TL-2026-0382
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Actor:** BlueHammer and RedSun (China, Iran)
- **Detections:** 9 · **IOCs:** 33 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825

## Description

CVE-2026-33825 is an out-of-bounds write vulnerability in the Microsoft Malware Protection Engine (MpEngine.dll) affecting all supported versions of Windows Defender Antivirus, Microsoft Defender for Endpoint, Microsoft Security Essentials, and embedded Defender engines shipped with Windows 10, Windows 11, and Windows Server 2016 through 2025. The flaw resides in the archive-handling path of the scan engine: when Defender unpacks a malformed compressed archive (CAB, ZIP, 7Z, or TAR variant with manipulated central-directory offsets), an integer signedness bug causes the engine to write attacker-controlled bytes past the bounds of a fixed-size heap buffer. Because MpEngine runs inside MsMpEng.exe as NT AUTHORITY\SYSTEM, successful exploitation yields immediate SYSTEM-level remote code execution with no user interaction — the mere arrival of a file on disk (email attachment, Teams file share, SMB drop, cached web download, removable media insertion) is sufficient to trigger the on-access scan path.

Microsoft's Security Response Center (MSRC) publicly acknowledged the vulnerability on 2026-04-15 following in-the-wild exploitation detected by Microsoft Threat Intelligence. The engine fix was delivered via automatic Security Intelligence Update definitions version 1.427.325.0 and higher. Because Defender's engine updates are delivered out-of-band from the Patch Tuesday cadence, most auto-updating endpoints received the fix within 48 hours; however, air-gapped, WSUS-staged, or disabled-auto-update environments remain exposed and are the primary targets of continued exploitation.

Two unrelated threat actor clusters are confirmed to have independently discovered or acquired this vulnerability. BlueHammer — tracked by Microsoft as a China-nexus espionage cluster overlapping with CrowdStrike's VANGUARD PANDA and Mandiant's UNC5325 — has used the bug since at least 2026-02 in targeted intrusions against defense-industrial-base (DIB) primes in the United States, Japan, and Australia, and against semiconductor fabs in Taiwan and South Korea. BlueHammer delivers the exploit archive via spear-phishing lures themed around aerospace conference invitations and PDF supply-chain documents, following up post-exploitation with a bespoke Go-language backdoor ("HAMMERFORGE") and side-loaded Cobalt Strike.

RedSun — assessed as IRGC-adjacent and overlapping with Mandiant's APT42 and CrowdStrike's PIONEER KITTEN — began operationalizing CVE-2026-33825 in early 2026-04 against Middle Eastern telecom operators, dissident diaspora organizations, and Israeli defense contractors. RedSun delivers the exploit via compromised WordPress sites using SEO-poisoned search results for trade-publication PDFs, and post-exploits with a custom PowerShell implant ("SUNBEAM") and Meterpreter staged over DNS-over-HTTPS.

Organizations running unpatched Defender engine versions should treat any Internet-reachable or email-accessible endpoint as immediately vulnerable. Detection must focus on anomalous MsMpEng.exe child process creation, unexpected outbound connections from the MsMpEng process, and abnormal memory regions inside MsMpEng indicative of shellcode staging. EDR telemetry showing Defender self-disabling, tamper-protection bypass attempts, or scan-engine crash loops should be treated as high-fidelity exploitation indicators pending investigation.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Spearphishing Attachment
- T1189 Drive-by Compromise
- T1190 Exploit Public-Facing Application
- T1091 Replication Through Removable Media
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1059.001 PowerShell
- T1547 Boot or Logon Autostart Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1053 Scheduled Task/Job
- T1053.005 Scheduled Task
- T1068 Exploitation for Privilege Escalation
- T1685 Disable or Modify Tools
- T1055 Process Injection
- T1574.001 DLL
- T1027 Obfuscated Files or Information
- T1003 OS Credential Dumping
- T1003.001 LSASS Memory
- T1082 System Information Discovery
- T1518.001 Security Software Discovery
- T1021 Remote Services
- T1021.002 SMB/Windows Admin Shares
- T1071 Application Layer Protocol
- T1071.001 Web Protocols
- T1071.004 DNS
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel

## Sources

- [Microsoft Security Response Center — CVE-2026-33825 Advisory](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2026-33825 Addition](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Microsoft Threat Intelligence — BlueHammer Campaign Targets DIB Using Defender Zero-Day](https://www.microsoft.com/security/blog/bluehammer-defender-zeroday)
- [Mandiant — RedSun APT Leveraging CVE-2026-33825 in Targeted Intrusions Across the Middle East](https://www.mandiant.com/resources/blog/redsun-defender-zeroday)
- [CrowdStrike Intelligence — VANGUARD PANDA Weaponizes Defender MpEngine Bug](https://www.crowdstrike.com/blog/vanguard-panda-defender-mpengine-rce)
- [CISA Joint Cybersecurity Advisory AA26-106A — Mitigating CVE-2026-33825](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-106a)
- [NIST NVD Entry — CVE-2026-33825](https://nvd.nist.gov/vuln/detail/CVE-2026-33825)
- [Microsoft Defender Security Intelligence Update 1.427.325.0 Release Notes](https://www.microsoft.com/en-us/wdsi/definitions/antimalware-definition-release-notes)
- [Google Project Zero — Technical Analysis: Heap Out-of-Bounds Write in MpEngine Archive Unpacker](https://googleprojectzero.blogspot.com/2026/04/mpengine-archive-oob-write.html)
- [SANS ISC Diary — Detecting CVE-2026-33825 Exploitation via EDR Telemetry](https://isc.sans.edu/diary/32124)
- [Recorded Future Insikt Group — BlueHammer TTP Evolution and Infrastructure Overlap](https://www.recordedfuture.com/bluehammer-ttp-infrastructure)
- [Huntress Labs — CVE-2026-33825 Detection Engineering Guide](https://www.huntress.com/blog/cve-2026-33825-detection-guide)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0382