--- title: Two Windows Defender zero-days dropped publicly after... description: A researcher publicly released proof-of-concept exploits for three Windows Defender vulnerabilities after a dispute with Microsoft over bug bounty payments.... canonical: https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Two Windows Defender zero-days dropped publicly after researcher claims Microsoft ignored bug reports | daily.dev og:description: A researcher publicly released proof-of-concept exploits for three Windows Defender vulnerabilities after a dispute with Microsoft over bug bounty payments.... og:url: https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx og:image: https://api.daily.dev/og/posts/gfhLKEZVx.png og:image:alt: Two Windows Defender zero-days dropped publicly after researcher claims Microsoft ignored bug reports og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Two Windows Defender zero-days dropped publicly after researcher claims Microsoft ignored bug reports **[Collections](https://daily.dev/sources/collections)** · 4 min read · 3 upvotes · 1 comments ## Summary A researcher publicly released proof-of-concept exploits for three Windows Defender vulnerabilities after a dispute with Microsoft over bug bounty payments. All three are now being actively exploited. BlueHammer (CVE-2026-33825) chains five Windows components to escalate privileges to SYSTEM via a TOCTOU race condition in Defender's update mechanism — patched in April 2026 Patch Tuesday. RedSun abuses Defender's handling of cloud-tagged files to write attacker-controlled content into System32, works on fully patched systems, and has no patch or CVE. UnDefend silently degrades Defender's threat intelligence while reporting the endpoint as healthy. Huntress Labs confirmed real-world intrusions using all three, with at least one traced to a Russian-geolocated IP via a compromised FortiGate VPN. The exploit code has over 100 GitHub forks. Defenders are advised to apply available patches, block execution from user-writable directories, enforce MFA on VPN, and add detection layers outside Defender's trust boundary. ## Content A researcher known online as Nightmare Eclipse (also referred to as Chaotic Eclipse in some reports) has publicly released proof-of-concept exploit code for three Windows Defender vulnerabilities after a dispute with Microsoft's Security Response Center over bug bounty payments. All three exploits are now being used in active attacks against real organizations, according to Huntress Labs. ## The three exploits ### BlueHammer (CVE-2026-33825) BlueHammer chains five Windows components — Defender, Volume Shadow Copy, the Cloud Files API, opportunistic locks, and Defender's RPC interface — to escalate any low-privileged user to `NT AUTHORITY\SYSTEM` in under a minute. The attack works by hijacking Defender's signature update process to mount a shadow copy, then freezing Defender with an opportunistic lock. From there, it extracts and decrypts NTLM hashes from the SAM database and spawns a SYSTEM shell. It then restores the original password hash to cover its tracks. More specifically, the exploit uses a TOCTOU (time-of-check time-of-use) race condition in Defender's update mechanism to swap a VDM file for a symlink pointing to the SAM hive. Microsoft patched BlueHammer in the April 2026 Patch Tuesday update. CISA has ordered U.S. federal agencies to apply the patch by May 7. Microsoft's only other response has been a Defender signature that detects the original compiled binary — recompiled variants go undetected. ### RedSun (no CVE assigned) RedSun targets `TieringEngineService.exe` and abuses a quirk in how Defender handles cloud-tagged files, such as OneDrive placeholders. When Defender detects a malicious file that carries a cloud marker, instead of deleting it, it rewrites the file back to its original location. RedSun exploits this by registering a fake cloud sync provider, then using a TOCTOU race condition combined with mount point redirection to trick Defender into writing attacker-controlled content into System32 as a service — effectively handing the attacker SYSTEM privileges. Security researcher Will Dormann confirmed the exploit works with close to 100% reliability. RedSun works on fully patched Windows 10, Windows 11, and Windows Server 2019 and later. There is no patch and no CVE assigned as of this writing. Microsoft has not responded to comment requests. ### UnDefend (no CVE assigned) UnDefend is deployed after SYSTEM access is achieved via one of the above exploits. It silently degrades Defender's threat intelligence updates while reporting the endpoint as healthy — essentially blinding the antivirus while making it appear to function normally. The researcher has also described it as capable of blocking Defender updates and disabling the product entirely. The researcher has threatened to release a remote code execution exploit next. ## Active exploitation Huntress Labs confirmed all three exploits have been observed in real intrusions. In at least one case, attackers gained initial access through a compromised FortiGate SSL VPN account, with activity traced to a Russian-geolocated source IP. Attackers staged binaries in low-noise directories like Pictures and Downloads before escalating privileges. The exploit code is publicly available on GitHub with over 100 forks, which means the barrier to entry for less sophisticated attackers is essentially zero. ## How the disclosure fell apart The researcher claims Microsoft's bug bounty program (MSRC) failed to compensate them appropriately for the findings. Rather than waiting for coordinated disclosure, they dropped working exploit code publicly. This is a good illustration of why the bug bounty process matters beyond just paying researchers — when it breaks down, the fallout lands on everyone else. ## What defenders can do For BlueHammer, apply the April 2026 Patch Tuesday updates immediately if you haven't already. For RedSun and UnDefend, which remain unpatched: - Block execution from user-writable directories (Pictures, Downloads, AppData, etc.) - Enforce MFA on VPN and remote access — the confirmed intrusion started with a compromised VPN credential - Add a detection layer outside Defender's trust boundary, since UnDefend specifically targets Defender's visibility - Monitor for VSS enumeration initiated by user-level processes - Watch for `CfRegisterSyncRoot` calls from unknown processes - Alert on low-privileged service creation - Track rapid back-to-back password change events (Windows event IDs 4723 and 4724) - Test untrusted executables in VMs or sandboxed environments rather than on production systems One technical note worth flagging: some discussion has come up about whether Rust's memory safety guarantees would have prevented these vulnerabilities. They wouldn't. BlueHammer and RedSun are logic-level race conditions, not memory corruption bugs. Language choice doesn't help here. ## Community discussion Top comments from developers on daily.dev. **@johnsoncross** · 0 upvotes > How do we actually defend ourselves from this vulnerabilities? Beginner-friendly. --- Tags: [#zero-day](https://daily.dev/tags/zero-day) [View this post on daily.dev](https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Two Windows Defender zero-days dropped publicly after researcher claims Microsoft ignored bug reports","url":"https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx"},"datePublished":"2026-04-16T16:15:47.004Z","dateModified":"2026-04-23T11:11:06.052Z","description":"A researcher publicly released proof-of-concept exploits for three Windows Defender vulnerabilities after a dispute with Microsoft over bug bounty payments....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/feb14e7d61bd13b1c1ed1e2c440ffd22?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/feb14e7d61bd13b1c1ed1e2c440ffd22?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":3},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"zero-day","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"Two Windows Defender zero-days dropped publicly after researcher claims Microsoft ignored bug reports"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/two-windows-defender-zero-days-dropped-publicly-after-researcher-claims-microsoft-ignored-bug-report-gfhlkezvx","comment":[{"@type":"Comment","text":"How do we actually defend ourselves from this vulnerabilities? Beginner-friendly.","datePublished":"2026-04-17T17:19:56.660Z","url":"https://daily.dev/posts/gfhLKEZVx#c-bpARPyJdg","author":{"@type":"Person","name":"Johnson Cross","url":"https://daily.dev/johnsoncross","image":"https://lh3.googleusercontent.com/a/ACg8ocK83PU74CejyVoAtIAqO43_oaPpnTgm_NPXvtDzdGRQeuqM2Q=s96-c"}}]} ```