Threat reportVulnerabilityTL-2026-4332
BlueHammer (CVE-2026-33825) - Windows Defender Local Privilege Escalation, Exploited In The Wild and Added to CISA KEV
BlueHammer (CVE-2026-33825) (TL-2026-4332), also tracked as BlueHammer, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-10-24. It has no confirmed attribution, affects Microsoft Microsoft Defender Antimalware Platform, references 1 CVE (CVE-2026-33825), maps to 15 MITRE ATT&CK techniques (T1003.001, T1003.002, T1003.003), and is covered by 9 detection rules and 15 indicators of compromise.
- CVSS
- 7.8/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 15Indicators of compromise
Key facts for TL-2026-4332
- Threat ID
- TL-2026-4332
- Also known as
- BlueHammer, FunnyApp
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- all sectors
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 15
Malware and tooling in BlueHammer (CVE-2026-33825)
Malware and tooling: BeigeBurrow, Exploit:Win32/DfndrPEBluHmr.BZ, Mimikatz
How BlueHammer (CVE-2026-33825) works
BlueHammer is a public PoC for CVE-2026-33825, an eight-stage local privilege escalation in the Microsoft Defender Antimalware Platform (before 4.18.26030.3011) that chains CloudFilter callbacks, batch oplocks and object-manager symlink races to make Defender read the SAM hive as SYSTEM, then resets the local admin hash via SAMR to obtain a SYSTEM shell. Huntress observed hands-on-keyboard use of the tooling after a FortiGate SSL VPN intrusion, and CISA added the CVE to KEV on 2026-04-22.
CVE-2026-33825 (CWE-1220, insufficient granularity of access control in Microsoft Defender, CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N) affects the Microsoft Defender Antimalware Platform before 4.18.26030.3011. The exploit, known as BlueHammer, was published on 2026-04-02 by a researcher using the aliases Chaotic Eclipse / Nightmare Eclipse before Microsoft had a patch, making it a true zero-day at disclosure. Microsoft fixed it on Patch Tuesday 2026-04-14 and the fix is delivered through platform updates via Windows Update / Microsoft Update. It requires existing standard-user code execution and does not provide initial access.
Qualys (2026-10-21, Prashant Sheshnaryan Pawar) reverse engineered the PoC (FunnyApp.exe, SHA-256 f4ffef42...b4a0). Stage 0 queries the Microsoft.Update.Session COM interface (category GUID E0789628-CE08-4437-BE74-2495B842F43B) for a pending Defender signature update and exits if none exists. Stage 1 downloads the signed mpam-fex64.exe from the Microsoft fwlink (go.microsoft.com/fwlink/?LinkID=121721) using a Chrome/141.0.0.0 User-Agent, extracts the embedded CAB in memory (mpasbase.vdm, mpavdlta.vdm, mpengine.dll) and swaps in a modified mpasbase.vdm. Stage 2 takes a batch oplock (FSCTL 0x90008) on RstrtMgr.dll, writes an EICAR test file (stored reversed in .rdata) to trigger a Defender scan, and watches the NT object namespace for new VSS snapshots (ShadowCopyFinderThread). Stage 3 registers the process as a CloudFilter sync-root provider (name IHATEMICROSOFT), drops a decoy foo.exe, and when MsMpEng.exe scans it the cldflt.sys callback (after verifying the caller is the WinDefend service) signals an event that freezes Defender in a controlled wait. Stage 4 builds a fake definition-update directory and an object-manager symlink \Sessions\<N>\BaseNamedObjects\<GUID>\WDUpdateDirectory. Stage 5 (WDCallerThread) calls Defender's update RPC interface c503f532-443a-4c69-8300-ccd1fbdb3839 over ncalrpc (endpoint IMpService77BDAF73-B396-481F-9042-AD358843EC24, procedure 42 ServerMpUpdateEngineSignature) and watches C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ via ReadDirectoryChangesW. Stage 6 places a batch oplock with FILE_DELETE_ON_CLOSE on mpasbase.vdm and, when Defender reopens it, swaps the symlinks so the read lands on \??\<VSS>\Windows\System32\Config\SAM. Stage 7 parses the SAM offline with offreg.dll (OROpenHiveByHandle), recovers the LSA bootkey from HKLM\SYSTEM\CurrentControlSet\Control\Lsa class names, decrypts NT hashes, calls SamiChangePasswordUser to set the administrator hash to the hard-coded string $PWNed666!!!WDFAIL, logs in, takes the UAC-linked elevated token, creates a temporary GUID-named LocalSystem service, and spawns a SYSTEM shell through conhost.exe. In the Qualys lab (Windows 11 Pro 21H2, Defender 4.18.2104.10) the chain was extended to Mimikatz LSASS credential recovery, pass-the-hash to a domain controller and NTDS.dit extraction.
In-the-wild use: Huntress (2026-04-20) reported an intrusion at one organization via compromised FortiGate SSL VPN credentials from Russian, Singaporean and Swiss IPs. FunnyApp.exe (BlueHammer; detected by Defender as Exploit:Win32/DfndrPEBluHmr.BZ) was executed 2026-04-10, and RedSun.exe and undef.exe (UnDefend, including an -agressive flag) were run on 2026-04-16. The operator also ran whoami /priv, cmdkey /list and net group, and deployed BeigeBurrow (agent.exe, a Go yamux-based reverse tunnel) to staybud.dpdns.org:443. Huntress could not attribute the activity and noted the operator appeared unfamiliar with UnDefend. CISA added CVE-2026-33825 to KEV on 2026-04-22 (due 2026-05-06) and TechSpot reports CISA flagged ransomware use, with no named groups. Note: the original hunt skeleton stated no in-the-wild exploitation and no KEV listing; later sources (NVD, Wiz, Huntress, TechSpot) supersede that. RedSun and UnDefend are related tools from the same publisher; sources reviewed do not assign them to CVE-2026-33825.
MITRE ATT&CK techniques used in TL-2026-4332
Credential Access
T1003.001 OS Credential Dumping: LSASS Memory; T1003.002 OS Credential Dumping: Security Account Manager; T1003.003 OS Credential Dumping: NTDS
Discovery
T1033 System Owner/User Discovery; T1518.001 Software Discovery: Security Software Discovery
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Command and Control
T1090 Proxy; T1572 Protocol Tunneling
Persistence
T1098 Account Manipulation; T1543.003 Create or Modify System Process: Windows Service
Privilege Escalation
T1134.001 Access Token Manipulation: Token Impersonation/Theft
Lateral Movement
T1550.002 Use Alternate Authentication Material: Pass the Hash
Execution
T1559 Inter-Process Communication
defense-impairment
Affected products and versions in BlueHammer (CVE-2026-33825)
- Microsoft — Microsoft Defender Antimalware Platform
Vulnerable versions: earlier than 4.18.26030.3011
Fixed in: 4.18.26030.3011
Remediation for BlueHammer (CVE-2026-33825)
Patches
- Microsoft Defender Antimalware Platform 4.18.26030.3011 or later (April 2026 Patch Tuesday, delivered via Windows Update / Microsoft Update)
Immediate actions
- Confirm Defender Antimalware Platform is 4.18.26030.3011 or later on all endpoints (Get-MpComputerStatus AMServiceVersion)
- Hunt for FunnyApp.exe, RedSun.exe, undef.exe, agent.exe -server ... -hide and the published hashes and network indicators
- Rotate credentials and review FortiGate SSL VPN logins from unexpected geographies where indicators are found
- Alert on local administrator password or hash changes via SAMR from non-administrative tooling
Workarounds
- No vendor workaround is documented in the reviewed sources; restrict standard-user code execution and monitor CloudFilter sync-root registration and Defender update RPC access
Longer-term hardening
- Deploy Windows LAPS for rotated local admin passwords
- Enable Credential Guard and LSA Protection
- Enforce WDAC/AppLocker allowlists to block unsigned user-writable executables
- Restrict privileged domain logons on workstations using tiering models
- Enforce MFA on SSL VPN access
CVEs associated with BlueHammer (CVE-2026-33825)
Weaknesses (CWE) in BlueHammer (CVE-2026-33825)
Timeline of BlueHammer (CVE-2026-33825)
- Researcher using the aliases Chaotic Eclipse / Nightmare Eclipse publicly releases the BlueHammer exploit before a Microsoft patch exists (zero-day at disclosure)
- Huntress observes FunnyApp.exe (BlueHammer variant) executed and quarantined by Defender in a victim environment
- Microsoft fixes CVE-2026-33825 on April Patch Tuesday via Antimalware Platform 4.18.26030.3011; NVD publishes the CVE with CVSS 7.8
- Unauthorized FortiGate SSL VPN access begins at 13:44:19 UTC using compromised credentials from Russian, Singaporean and Swiss IPs
- RedSun.exe and UnDefend (undef.exe) execution observed in the same intrusion, along with hands-on-keyboard discovery commands and BeigeBurrow tunnel deployment
- Huntress publishes findings on in-the-wild use of the Nightmare-Eclipse tooling
- CISA adds CVE-2026-33825 to the Known Exploited Vulnerabilities catalog
- CISA federal remediation deadline for CVE-2026-33825
- Qualys publishes a full eight-stage reverse-engineering analysis of BlueHammer with lab-demonstrated domain compromise chain
Sources cited for BlueHammer (CVE-2026-33825)
- The Science of Exploitability: Decoding BlueHammer (Qualys)
- NVD - CVE-2026-33825
- Microsoft MSRC Update Guide - CVE-2026-33825
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-33825
- Huntress - In-the-wild exploitation of Nightmare-Eclipse tooling
- Picus Security - BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Explained
- TechSpot - Microsoft Defender flaw now linked to ransomware attacks
- Wiz Vulnerability Database - CVE-2026-33825
Detection coverage for TL-2026-4332
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4332 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.