# Windows Defender Zero-Days (BlueHammer/RedSun/UnDefend) — Leaked Nightmare-Eclipse Exploits Weaponized In-The-Wild for SYSTEM LPE (CVE-2026-33825)

> Three Windows Defender / MpClient.dll vulnerabilities — BlueHammer (CVE-2026-33825), RedSun, and UnDefend — disclosed by the Nightmare-Eclipse leak collective on 2026-04-14 are under active exploitation as post-compromise SYSTEM-level local privilege escalation primitives. BlueHammer was patched on 2026-04-08 Patch Tuesday but RedSun and UnDefend remain unpatched 0-days with no vendor mitigation. Huntress has confirmed hands-on-keyboard operators chaining these after SSLVPN initial access to elevate to NT AUTHORITY\\SYSTEM, disable Defender telemetry, and stage lateral movement.

- **Published:** 2026-04-17T12:00:00Z
- **Last reviewed:** 2026-04-17T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0387
- **ID:** TL-2026-0387
- **Severity:** CRITICAL (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 25 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825

## Description

On 2026-04-14 the Nightmare-Eclipse leak collective — a loose affiliate group historically linked to the ShadowBrokers-style dump economy — published a trove of three previously unknown Windows Defender exploits alongside working proof-of-concept code on a Tor hidden service and a mirror at github.com/nightmare-eclipse-analysis/defender-zero-days. The dump contained internal Microsoft tracking IDs, weaponized x64 PoCs compiled on 2026-03-28, and an operator's runbook detailing how to chain the three bugs for reliable SYSTEM elevation on Windows 10 21H2 through Windows 11 24H2 and Windows Server 2019 through 2025.

BlueHammer (CVE-2026-33825) is an arbitrary file write-as-SYSTEM in the Microsoft Malware Protection Engine (MpEngine) that abuses a symlink race in the MpCmdRun.exe quarantine restore path. When an administrator invokes 'MpCmdRun.exe -Restore -Name <item>', MpEngine briefly opens a world-writable directory under %ProgramData%\Microsoft\Windows Defender\Quarantine\Resource with impersonation dropped to SYSTEM. An unprivileged local attacker who plants a junction pointing the Resource directory to C:\Windows\System32 and races the restore operation can coerce MpEngine into writing attacker-controlled bytes to any location, including DLL planting against services that auto-start as SYSTEM (e.g., printconfig.dll loaded by the Print Spooler). Microsoft patched BlueHammer in Defender platform update KB5048987 shipped via Antimalware Platform 4.18.2604.3 on 2026-04-08.

RedSun is an unpatched 0-day — an out-of-bounds write in MpClient.dll's asynchronous IOCTL handler (IOCTL 0x226004) exposed by the \\.\WinDefend device. A crafted IRP with a malformed ScanContext header size field (signed integer underflow when size < sizeof(ScanContextHeader)) causes MpClient to copy attacker-controlled bytes past the end of a pool allocation. Reliable exploitation overwrites an adjacent _POOL_HEADER and eventually the PreviousMode byte of the calling thread's KTHREAD, promoting subsequent Nt* syscalls to kernel-mode privilege. The leaked PoC (redsun_poc.exe) demonstrates full SYSTEM shell within ~600ms on default-configured Windows 11 23H2 with HVCI disabled; HVCI-protected systems are mitigated against the kernel-read/write primitive but remain vulnerable to the pool corruption itself.

UnDefend is an unpatched tampering / telemetry-suppression 0-day. It abuses an under-documented WMI method 'MSFT_MpPreference::Reset' exposed to authenticated local users through the root\Microsoft\Windows\Defender namespace. The method fails to validate that the caller holds SeTcbPrivilege and instead checks only whether the process token is elevated (integrity level High), enabling any medium-IL-to-high-IL bypass (e.g., fodhelper UAC bypass + UnDefend) to silently clear tamper-protection flags, disable real-time monitoring, stop the Sense / WinDefend services, and purge Defender's historical detection telemetry from the EtwDiagnosticLog channel. No CVE has been assigned as of 2026-04-17; Microsoft has acknowledged receipt and advises disabling WMI remoting (which does not mitigate the local vector).

Huntress Managed EDR telemetry covering ~1.3M endpoints first observed in-the-wild exploitation on 2026-04-15 — roughly 24 hours after the public dump — against three financial-sector customers breached via an Ivanti Connect Secure SSLVPN credential-stuffing campaign. Hands-on-keyboard operators (tracked as Huntress cluster HT-CL-2026-019) were observed staging the leaked PoCs to C:\ProgramData\Intel\Logs\, chaining RedSun -> UnDefend to suppress Defender, then pivoting to Cobalt Strike beacons via DLL sideloading against goopdate.dll. Attribution is currently assessed as MEDIUM confidence to a financially-motivated access-broker cluster with loose affiliation to the BlackSuit ransomware ecosystem, based on reuse of TLS JA3 fingerprint 51c64c77e60f3980eea90869b68c58a8 and shared C2 infrastructure on AS14061 (DigitalOcean) also seen in 2026-Q1 BlackSuit intrusions.

Defenders should (1) deploy KB5048987 immediately for BlueHammer, (2) enforce Attack Surface Reduction rule 'Block abuse of exploited vulnerable signed drivers' and 'Block credential stealing from LSASS' as defense-in-depth against the RedSun kernel primitive, (3) alert on any process creating \\.\WinDefend handles outside of MsMpEng.exe / NisSrv.exe / SenseCE.exe, (4) monitor WMI __InstanceModificationEvent on MSFT_MpPreference with a hard-block EDR rule, (5) verify tamper-protection state from an out-of-band source (Intune / Defender portal) because local APIs are untrusted while UnDefend remains unpatched, and (6) hunt for the leaked PoC SHA256 hashes and staging directories detailed in the IOC section.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1106 Native API
- T1047 Windows Management Instrumentation
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1548 Abuse Elevation Control Mechanism
- T1685 Disable or Modify Tools
- T1070 Indicator Removal
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1518 Software Discovery
- T1021 Remote Services
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact

## Sources

- [Microsoft Security Advisory CVE-2026-33825 — Windows Defender Elevation of Privilege Vulnerability (BlueHammer)](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825)
- [Microsoft Defender Antimalware Platform Update KB5048987](https://support.microsoft.com/en-us/topic/kb5048987)
- [Huntress: Windows Defender Zero-Days Exploited In-The-Wild After SSLVPN Breaches](https://www.huntress.com/blog/windows-defender-zero-days-in-the-wild)
- [BleepingComputer: Leaked Nightmare-Eclipse Defender Exploits Used in Attacks](https://www.bleepingcomputer.com/news/security/leaked-nightmare-eclipse-defender-exploits-used-in-attacks/)
- [Nightmare-Eclipse Leak Dump Analysis — BlueHammer/RedSun/UnDefend](https://github.com/nightmare-eclipse-analysis/defender-zero-days)
- [CISA Alert AA26-106A — Active Exploitation of Leaked Windows Defender Zero-Days](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-106a)
- [Microsoft MSRC Blog: On the Nightmare-Eclipse Disclosure and Defender Defense-in-Depth](https://msrc.microsoft.com/blog/2026/04/nightmare-eclipse-response/)
- [Project Zero: BlueHammer Root-Cause Analysis — MpCmdRun Quarantine Restore Symlink Race](https://googleprojectzero.blogspot.com/2026/04/bluehammer-rca.html)
- [Huntress PoC Triage: redsun_poc.exe / undefend_poc.exe Static Analysis](https://www.huntress.com/blog/redsun-undefend-poc-triage)
- [NVD: CVE-2026-33825](https://nvd.nist.gov/vuln/detail/CVE-2026-33825)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0387