# BlueHammer (CVE-2026-33825) - Windows Defender Local Privilege Escalation, Exploited In The Wild and Added to CISA KEV

> BlueHammer is a public PoC for CVE-2026-33825, an eight-stage local privilege escalation in the Microsoft Defender Antimalware Platform (before 4.18.26030.3011) that chains CloudFilter callbacks, batch oplocks and object-manager symlink races to make Defender read the SAM hive as SYSTEM, then resets the local admin hash via SAMR to obtain a SYSTEM shell. Huntress observed hands-on-keyboard use of the tooling after a FortiGate SSL VPN intrusion, and CISA added the CVE to KEV on 2026-04-22.

- **Published:** 2026-10-24T02:31:32Z
- **Last reviewed:** 2026-10-24T02:31:32Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4332
- **ID:** TL-2026-4332
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-33825

## Description

CVE-2026-33825 (CWE-1220, insufficient granularity of access control in Microsoft Defender, CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N) affects the Microsoft Defender Antimalware Platform before 4.18.26030.3011. The exploit, known as BlueHammer, was published on 2026-04-02 by a researcher using the aliases Chaotic Eclipse / Nightmare Eclipse before Microsoft had a patch, making it a true zero-day at disclosure. Microsoft fixed it on Patch Tuesday 2026-04-14 and the fix is delivered through platform updates via Windows Update / Microsoft Update. It requires existing standard-user code execution and does not provide initial access.

Qualys (2026-10-21, Prashant Sheshnaryan Pawar) reverse engineered the PoC (FunnyApp.exe, SHA-256 f4ffef42...b4a0). Stage 0 queries the Microsoft.Update.Session COM interface (category GUID E0789628-CE08-4437-BE74-2495B842F43B) for a pending Defender signature update and exits if none exists. Stage 1 downloads the signed mpam-fex64.exe from the Microsoft fwlink (go.microsoft.com/fwlink/?LinkID=121721) using a Chrome/141.0.0.0 User-Agent, extracts the embedded CAB in memory (mpasbase.vdm, mpavdlta.vdm, mpengine.dll) and swaps in a modified mpasbase.vdm. Stage 2 takes a batch oplock (FSCTL 0x90008) on RstrtMgr.dll, writes an EICAR test file (stored reversed in .rdata) to trigger a Defender scan, and watches the NT object namespace for new VSS snapshots (ShadowCopyFinderThread). Stage 3 registers the process as a CloudFilter sync-root provider (name IHATEMICROSOFT), drops a decoy foo.exe, and when MsMpEng.exe scans it the cldflt.sys callback (after verifying the caller is the WinDefend service) signals an event that freezes Defender in a controlled wait. Stage 4 builds a fake definition-update directory and an object-manager symlink \Sessions\<N>\BaseNamedObjects\<GUID>\WDUpdateDirectory. Stage 5 (WDCallerThread) calls Defender's update RPC interface c503f532-443a-4c69-8300-ccd1fbdb3839 over ncalrpc (endpoint IMpService77BDAF73-B396-481F-9042-AD358843EC24, procedure 42 ServerMpUpdateEngineSignature) and watches C:\ProgramData\Microsoft\Windows Defender\Definition Updates\ via ReadDirectoryChangesW. Stage 6 places a batch oplock with FILE_DELETE_ON_CLOSE on mpasbase.vdm and, when Defender reopens it, swaps the symlinks so the read lands on \??\<VSS>\Windows\System32\Config\SAM. Stage 7 parses the SAM offline with offreg.dll (OROpenHiveByHandle), recovers the LSA bootkey from HKLM\SYSTEM\CurrentControlSet\Control\Lsa class names, decrypts NT hashes, calls SamiChangePasswordUser to set the administrator hash to the hard-coded string $PWNed666!!!WDFAIL, logs in, takes the UAC-linked elevated token, creates a temporary GUID-named LocalSystem service, and spawns a SYSTEM shell through conhost.exe. In the Qualys lab (Windows 11 Pro 21H2, Defender 4.18.2104.10) the chain was extended to Mimikatz LSASS credential recovery, pass-the-hash to a domain controller and NTDS.dit extraction.

In-the-wild use: Huntress (2026-04-20) reported an intrusion at one organization via compromised FortiGate SSL VPN credentials from Russian, Singaporean and Swiss IPs. FunnyApp.exe (BlueHammer; detected by Defender as Exploit:Win32/DfndrPEBluHmr.BZ) was executed 2026-04-10, and RedSun.exe and undef.exe (UnDefend, including an -agressive flag) were run on 2026-04-16. The operator also ran whoami /priv, cmdkey /list and net group, and deployed BeigeBurrow (agent.exe, a Go yamux-based reverse tunnel) to staybud.dpdns.org:443. Huntress could not attribute the activity and noted the operator appeared unfamiliar with UnDefend. CISA added CVE-2026-33825 to KEV on 2026-04-22 (due 2026-05-06) and TechSpot reports CISA flagged ransomware use, with no named groups. Note: the original hunt skeleton stated no in-the-wild exploitation and no KEV listing; later sources (NVD, Wiz, Huntress, TechSpot) supersede that. RedSun and UnDefend are related tools from the same publisher; sources reviewed do not assign them to CVE-2026-33825.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1559 Inter-Process Communication
- T1098 Account Manipulation
- T1543.003 Create or Modify System Process: Windows Service
- T1134.001 Access Token Manipulation: Token Impersonation/Theft
- T1685 Disable or Modify Tools
- T1003.002 OS Credential Dumping: Security Account Manager
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.003 OS Credential Dumping: NTDS
- T1518.001 Software Discovery: Security Software Discovery
- T1033 System Owner/User Discovery
- T1550.002 Use Alternate Authentication Material: Pass the Hash
- T1572 Protocol Tunneling
- T1090 Proxy

## Sources

- [The Science of Exploitability: Decoding BlueHammer (Qualys)](https://blog.qualys.com/product-tech/2026/10/21/bluehammer-cve-2026-33825-windows-defender-privilege-escalation)
- [NVD - CVE-2026-33825](https://nvd.nist.gov/vuln/detail/CVE-2026-33825)
- [Microsoft MSRC Update Guide - CVE-2026-33825](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-33825](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-33825)
- [Huntress - In-the-wild exploitation of Nightmare-Eclipse tooling](https://www.huntress.com/blog/nightmare-eclipse-intrusion)
- [Picus Security - BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Explained](https://www.picussecurity.com/resource/blog/bluehammer-redsun-windows-defender-cve-2026-33825-zero-day-vulnerability-explained)
- [TechSpot - Microsoft Defender flaw now linked to ransomware attacks](https://www.techspot.com/news/112962-microsoft-defender-flaw-now-linked-ransomware-attacks.html)
- [Wiz Vulnerability Database - CVE-2026-33825](https://www.wiz.io/vulnerability-database/cve/cve-2026-33825)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4332