cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

CISA Says BlueHammer Flaw Used in Ransomware Campaigns

· Original article ↗

Summary

CISA says the BlueHammer Microsoft Defender flaw (CVE-2026-33825) has been used in ransomware campaigns. Huntress reported pre-patch zero-day exploitation; Microsoft has not confirmed in-the-wild exploitation, and the ransomware group is unknown.

Key points

  • CISA updated its Known Exploited Vulnerabilities catalog entry to say CVE-2026-33825 was leveraged in ransomware campaigns.
  • The ransomware group involved is unknown, and the article says recent reports describing exploitation were not apparent.
  • Huntress observed the vulnerability exploited as a zero-day before Microsoft released patches.
  • Microsoft’s advisory says exploitation is more likely but does not confirm in-the-wild exploitation.
  • Microsoft says an authenticated attacker can exploit the flaw for privilege escalation; patches were released April 14.

Article Details

Vulnerability Types
  • Privilege escalation
Exploitation Status
active
Exploit Availability
public_exploit
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationAn authenticated attacker can exploit CVE-2026-33825 for privilege escalation.

CVE

CVE-2026-33825A Microsoft Defender vulnerability tracked as BlueHammer and CVE-2026-33825 is being exploited in ransomware attacks, according to the cybersecurity agency CISA.

People

Chaotic EclipseThe researcher publicly disclosed BlueHammer and other exploits; the article says the researcher is also known as Nightmare Eclipse.Nightmare EclipseThe researcher publicly disclosed BlueHammer and other exploits; the article says the researcher is also known as Chaotic Eclipse.

Vendors

GreyNoiseThreat intelligence firm GreyNoise released a free tool earlier this year to help track these KEV updates.HuntressCybersecurity firm Huntress saw the vulnerability being exploited in attacks as a zero-day before Microsoft released patches.MicrosoftA Microsoft Defender vulnerability tracked as BlueHammer and CVE-2026-33825 is being exploited in ransomware attacks, according to the cybersecurity agency CISA.

Products

Microsoft Defender Antimalware PlatformA Microsoft Defender vulnerability tracked as BlueHammer and CVE-2026-33825 is being exploited in ransomware attacks, according to the cybersecurity agency CISA.

Related Articles