Huntress Says RedSun and UnDefend Exploits Used Alongside BlueHammer
Summary
Huntress says attackers used RedSun and UnDefend Microsoft Defender exploit PoCs alongside BlueHammer. The attacks involved renamed files in user folders and commands to map privileges, recover credentials, and enumerate Active Directory.
Key points
- An anonymous researcher using the aliases Chaotic Eclipse and Nightmare Eclipse published the RedSun and UnDefend PoCs on April 16.
- RedSun enables privilege escalation; UnDefend can block Defender signature updates or disable Defender during a major update.
- Huntress observed all three techniques—BlueHammer, RedSun, and UnDefend—used in real-world attacks by at least one threat actor.
- Attackers placed renamed exploit files in users’ Pictures and Downloads folders, then mapped privileges, discovered stored credentials, and enumerated Active Directory.
- Huntress said it isolated the affected organization to prevent further post-exploitation.
- Microsoft patched BlueHammer as CVE-2026-33825 on April 14; the article says an out-of-band fix may be needed for the new exploits.
Article Details
- Vulnerability Types
- Privilege escalation
- Blocking Microsoft Defender signature updates or disabling Microsoft Defender
- Exploitation Status
- active
- Exploit Availability
- public_poc
- Patch Status
- partial
MITRE ATT&CK
T1036 · MasqueradingAttackers renamed exploit files placed in users’ Pictures and Downloads folders to avoid suspicion.T1068 · Exploitation for Privilege EscalationBlueHammer and RedSun are privilege-escalation exploits used in the observed attacks.T1555 · Credentials from Password StoresBefore launching the exploits, attackers ran commands to discover stored credentials.T1562.001 · Disable or Modify ToolsUnDefend can block Microsoft Defender signature updates or disable Defender during a major update.
CVE
People
Chaotic EclipseAnonymous researcher, also using the alias Nightmare Eclipse, who published the BlueHammer, RedSun, and UnDefend proof-of-concept exploits.Will DormannVulnerability analyst who confirmed the effectiveness of the RedSun proof of concept.Yuanpei XuCredited with reporting the BlueHammer vulnerability.Zen DoddCredited with reporting the BlueHammer vulnerability.
Vendors
Products
Tools
BlueHammerexploits for Microsoft Defender, named RedSun and UnDefend, after earlier publishing BlueHammer.RedSunEclipse released two new proof-of-concept privilege-escalation exploits for Microsoft Defender, named RedSun and UnDefend, after earlier publishing BlueHammer.UnDefendreleased two new proof-of-concept privilege-escalation exploits for Microsoft Defender, named RedSun and UnDefend, after earlier publishing BlueHammer.