Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend) — Leaked Nightmare-Eclipse Exploits Weaponized In-The-Wild for SYSTEM LPE (CVE-2026-33825)

Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend) (TL-2026-0387), also tracked as BlueHammer, is a critical-severity software vulnerability scored CVSS 8.8, first published 2026-04-17. It has no confirmed attribution, affects Microsoft Windows Defender Antimalware Platform (MpEngine / MpCmdRun), references 1 CVE (CVE-2026-33825), maps to 19 MITRE ATT&CK techniques (T1003, T1021, T1036), and is covered by 9 detection rules and 25 indicators of compromise.

Key facts for TL-2026-0387

Threat ID
TL-2026-0387
Also known as
BlueHammer, RedSun, UnDefend, Nightmare-Eclipse Defender Dump, Defender-Trinity
Severity
CRITICAL
CVSS
8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-04-17
Last reviewed
2026-04-17
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
financial, healthcare, technology, government, managed-service-providers, manufacturing, legal
Target regions
North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
25

Malware and tooling in Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

Malware and tooling: BlackSuit Ransomware Affiliate Tooling, Cobalt Strike, Mimikatz (reflective DLL via Cobalt Strike)

Three Windows Defender / MpClient.dll vulnerabilities — BlueHammer (CVE-2026-33825), RedSun, and UnDefend — disclosed by the Nightmare-Eclipse leak collective on 2026-04-14 are under active exploitation as post-compromise SYSTEM-level local privilege escalation primitives. BlueHammer was patched on 2026-04-08 Patch Tuesday but RedSun and UnDefend remain unpatched 0-days with no vendor mitigation. Huntress has confirmed hands-on-keyboard operators chaining these after SSLVPN initial access to elevate to NT AUTHORITY\\SYSTEM, disable Defender telemetry, and stage lateral movement.

How Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend) works

On 2026-04-14 the Nightmare-Eclipse leak collective — a loose affiliate group historically linked to the ShadowBrokers-style dump economy — published a trove of three previously unknown Windows Defender exploits alongside working proof-of-concept code on a Tor hidden service and a mirror at github.com/nightmare-eclipse-analysis/defender-zero-days. The dump contained internal Microsoft tracking IDs, weaponized x64 PoCs compiled on 2026-03-28, and an operator's runbook detailing how to chain the three bugs for reliable SYSTEM elevation on Windows 10 21H2 through Windows 11 24H2 and Windows Server 2019 through 2025.

BlueHammer (CVE-2026-33825) is an arbitrary file write-as-SYSTEM in the Microsoft Malware Protection Engine (MpEngine) that abuses a symlink race in the MpCmdRun.exe quarantine restore path. When an administrator invokes 'MpCmdRun.exe -Restore -Name <item>', MpEngine briefly opens a world-writable directory under %ProgramData%\Microsoft\Windows Defender\Quarantine\Resource with impersonation dropped to SYSTEM. An unprivileged local attacker who plants a junction pointing the Resource directory to C:\Windows\System32 and races the restore operation can coerce MpEngine into writing attacker-controlled bytes to any location, including DLL planting against services that auto-start as SYSTEM (e.g., printconfig.dll loaded by the Print Spooler). Microsoft patched BlueHammer in Defender platform update KB5048987 shipped via Antimalware Platform 4.18.2604.3 on 2026-04-08.

RedSun is an unpatched 0-day — an out-of-bounds write in MpClient.dll's asynchronous IOCTL handler (IOCTL 0x226004) exposed by the \\.\WinDefend device. A crafted IRP with a malformed ScanContext header size field (signed integer underflow when size < sizeof(ScanContextHeader)) causes MpClient to copy attacker-controlled bytes past the end of a pool allocation. Reliable exploitation overwrites an adjacent _POOL_HEADER and eventually the PreviousMode byte of the calling thread's KTHREAD, promoting subsequent Nt* syscalls to kernel-mode privilege. The leaked PoC (redsun_poc.exe) demonstrates full SYSTEM shell within ~600ms on default-configured Windows 11 23H2 with HVCI disabled; HVCI-protected systems are mitigated against the kernel-read/write primitive but remain vulnerable to the pool corruption itself.

UnDefend is an unpatched tampering / telemetry-suppression 0-day. It abuses an under-documented WMI method 'MSFT_MpPreference::Reset' exposed to authenticated local users through the root\Microsoft\Windows\Defender namespace. The method fails to validate that the caller holds SeTcbPrivilege and instead checks only whether the process token is elevated (integrity level High), enabling any medium-IL-to-high-IL bypass (e.g., fodhelper UAC bypass + UnDefend) to silently clear tamper-protection flags, disable real-time monitoring, stop the Sense / WinDefend services, and purge Defender's historical detection telemetry from the EtwDiagnosticLog channel. No CVE has been assigned as of 2026-04-17; Microsoft has acknowledged receipt and advises disabling WMI remoting (which does not mitigate the local vector).

Huntress Managed EDR telemetry covering ~1.3M endpoints first observed in-the-wild exploitation on 2026-04-15 — roughly 24 hours after the public dump — against three financial-sector customers breached via an Ivanti Connect Secure SSLVPN credential-stuffing campaign. Hands-on-keyboard operators (tracked as Huntress cluster HT-CL-2026-019) were observed staging the leaked PoCs to C:\ProgramData\Intel\Logs\, chaining RedSun -> UnDefend to suppress Defender, then pivoting to Cobalt Strike beacons via DLL sideloading against goopdate.dll. Attribution is currently assessed as MEDIUM confidence to a financially-motivated access-broker cluster with loose affiliation to the BlackSuit ransomware ecosystem, based on reuse of TLS JA3 fingerprint 51c64c77e60f3980eea90869b68c58a8 and shared C2 infrastructure on AS14061 (DigitalOcean) also seen in 2026-Q1 BlackSuit intrusions.

Defenders should (1) deploy KB5048987 immediately for BlueHammer, (2) enforce Attack Surface Reduction rule 'Block abuse of exploited vulnerable signed drivers' and 'Block credential stealing from LSASS' as defense-in-depth against the RedSun kernel primitive, (3) alert on any process creating \\.\WinDefend handles outside of MsMpEng.exe / NisSrv.exe / SenseCE.exe, (4) monitor WMI __InstanceModificationEvent on MSFT_MpPreference with a hard-block EDR rule, (5) verify tamper-protection state from an out-of-band source (Intune / Defender portal) because local APIs are untrusted while UnDefend remains unpatched, and (6) hunt for the leaked PoC SHA256 hashes and staging directories detailed in the IOC section.

MITRE ATT&CK techniques used in TL-2026-0387

Credential Access

T1003 OS Credential Dumping

Lateral Movement

T1021 Remote Services

Defense Evasion

T1036 Masquerading; T1070 Indicator Removal

Execution

T1047 Windows Management Instrumentation; T1059 Command and Scripting Interpreter; T1106 Native API

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Discovery

T1082 System Information Discovery; T1518 Software Discovery

Impact

T1486 Data Encrypted for Impact

stealth

T1574 Hijack Execution Flow

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

  • Microsoft — Windows Defender Antimalware Platform (MpEngine / MpCmdRun)
    Vulnerable versions: < 4.18.2604.3
    Fixed in: 4.18.2604.3 (KB5048987, 2026-04-08) — BlueHammer only
  • Microsoft — Windows Defender MpClient.dll (WinDefend IOCTL handler)
    Vulnerable versions: All versions shipping on Windows 10 21H2 through Windows 11 24H2 and Server 2019 through 2025 as of 2026-04-17
  • Microsoft — Windows 10
    Vulnerable versions: 21H2; 22H2
  • Microsoft — Windows 11
    Vulnerable versions: 22H2; 23H2; 24H2
  • Microsoft — Windows Server
    Vulnerable versions: 2019; 2022; 2025

Remediation for Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

Patches

  • KB5048987 — Microsoft Defender Antimalware Platform 4.18.2604.3 — patches CVE-2026-33825 (BlueHammer). Released 2026-04-08.
  • No patch available for RedSun (MpClient.dll IOCTL 0x226004 OOB write) as of 2026-04-17 — Microsoft has acknowledged the report and indicated an out-of-band update is under development.
  • No patch available for UnDefend (WMI MSFT_MpPreference::Reset privilege bypass) as of 2026-04-17.

Immediate actions

  • Deploy Microsoft Defender Antimalware Platform update KB5048987 (4.18.2604.3 or later) to patch BlueHammer / CVE-2026-33825 on all Windows endpoints and servers
  • Enable and enforce Defender Tamper Protection via Intune / Configuration Manager and verify state from the cloud portal — do NOT trust local WMI/PowerShell readings while UnDefend is unpatched
  • Deploy EDR block rule: kill any non-Microsoft-signed process that opens a handle to \\.\WinDefend (IOCTL device)
  • Deploy EDR block rule: alert/block on WMI __InstanceModificationEvent against root\Microsoft\Windows\Defender::MSFT_MpPreference
  • Block and hunt for IOCs in the IOC list — file hashes, C2 IPs, staging directories, JA3 fingerprints
  • Enforce emergency SSLVPN credential rotation and require phishing-resistant MFA (FIDO2/WebAuthn) on Ivanti Connect Secure and comparable SSLVPN gateways
  • For critical systems with no KB5048987 coverage yet, disable the MpCmdRun.exe -Restore code path via AppLocker until patch rollout completes

Workarounds

  • BlueHammer: restrict NTFS reparse-point creation under %ProgramData%\Microsoft\Windows Defender\Quarantine via fsutil behavior set SymlinkEvaluation R2L:0; block MpCmdRun.exe -Restore via AppLocker
  • RedSun: enable HVCI to neutralize the PreviousMode overwrite; deploy WDAC policy blocking unsigned user-mode code that imports NtDeviceIoControlFile targeting \\.\WinDefend
  • UnDefend: DENY :Everyone on the root\Microsoft\Windows\Defender WMI namespace Remote/Enable permissions via wmimgmt.msc; cloud-enforce tamper protection in Defender for Endpoint which supersedes local WMI overrides

Longer-term hardening

  • Enable HVCI (Memory Integrity) across the fleet — mitigates the RedSun kernel R/W primitive by blocking PreviousMode overwrites
  • Enable Attack Surface Reduction rule 'Block abuse of exploited vulnerable signed drivers' (GUID 56a863a9-875e-4185-98a7-b882c64b5ce5) and 'Block credential stealing from LSASS' (GUID 9e6c4e1f-7d60-472f-ba1a-a39ef669e4b2)
  • Deploy cloud-delivered protection and sample submission in Defender so detection logic updates faster than monthly cumulative cycles
  • Roll out Defender for Endpoint Plan 2 with tamper-protection cloud enforcement and weekly tamper-audit reports
  • Establish an out-of-band telemetry channel (Defender portal / Sentinel) as the source of truth for Defender health; alert if on-device WMI disagrees with cloud state
  • Harden WMI: remove non-required users from the root\Microsoft\Windows\Defender namespace DACL; audit WMI provider invocations via Sysmon Event 19/20/21
  • Segment networks so that SSLVPN-adjacent hosts cannot directly reach Tier-0 assets without passing through a PAW / jump host

CVEs associated with Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

CVE-2026-33825

Weaknesses (CWE) in Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

CWE-59, CWE-787, CWE-269, CWE-367, CWE-284

Timeline of Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

  • An independent researcher reports the BlueHammer MpCmdRun quarantine-restore symlink race (later CVE-2026-33825) to Microsoft MSRC under case MSRC-84221.
  • Microsoft confirms BlueHammer and internally tracks additional related Defender bugs (RedSun, UnDefend) surfaced during regression testing; target fix date set for April 2026 Patch Tuesday.
  • PE timestamps on the later-leaked PoC binaries (bluehammer_poc.exe, redsun_poc.exe, undefend_poc.exe) indicate compilation on this date, predating the public leak by ~17 days.
  • Microsoft April 2026 Patch Tuesday ships Defender Antimalware Platform update KB5048987 (4.18.2604.3) fixing BlueHammer / CVE-2026-33825. RedSun and UnDefend remain unpatched.
  • Nightmare-Eclipse collective publishes the three Defender exploits on a Tor hidden service and mirrors to github.com/nightmare-eclipse-analysis/defender-zero-days; Microsoft internal IDs exposed confirming leak provenance from an MSRC-adjacent source.
  • Huntress Managed EDR first observes in-the-wild exploitation against three financial-sector customers; operators chain RedSun -> UnDefend to elevate and suppress Defender after Ivanti Connect Secure SSLVPN compromise.
  • Huntress assesses MEDIUM-confidence attribution to cluster HT-CL-2026-019, a financially-motivated access broker loosely affiliated with the BlackSuit ransomware ecosystem, based on JA3 fingerprint reuse and shared AS14061 C2 infrastructure.
  • Huntress publishes public blog and IOCs; BleepingComputer amplifies; CISA releases Alert AA26-106A warning of active exploitation and urging immediate KB5048987 deployment.
  • Threadlinqs Intelligence publishes TL-2026-0387 with full detection coverage (Splunk SPL, Microsoft Sentinel KQL, Sigma) and attack simulations for the Defender exploit chain.
  • CVE-2026-33825 (BlueHammer) added to the CISA Known Exploited Vulnerabilities catalog with a federal patch deadline of 2026-05-01.
  • As of 2026-05-29, this remains a live concern: BlueHammer (CVE-2026-33825) was patched in April, and RedSun/UnDefend were finally fixed out-of-band on 2026-05-21 as CVE-2026-41091/CVE-2026-45498, but all three are actively exploited, sit in CISA KEV (June 3 deadline), and the Nightmare-Eclipse researcher is threatening new RCE 0-days for June Patch Tuesday.

Sources cited for Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

Threats related to Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend)

Detection coverage for TL-2026-0387

As of 2026-04-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0387 across Splunk SPL, Microsoft KQL and Sigma, covering 25 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats