Image source: PJ McDonnell, Shutterstock
Attackers are using Blue Hammer, RedSun and UnDefend exploits in targeted, hands-on intrusions.
Threat actors are actively exploiting three publicly available proof-of-concept attacks to compromise Microsoft Defender, the security platform built into most Windows systems. Two of the exploits enable SYSTEM-level access, while a third degrades Defender’s ability to detect threats—effectively turning the tool against the environments it is meant to protect.
🔴 Top risk
Risk Level: High
Impact: Critical
Exploit Status: Active (targeted)
Executive Take: Attackers are subverting native and trusted security controls to take over systems.
🔎Bottom line: When endpoint protection tools can be turned against the enterprise, security teams must assume that compromise can occur within trusted layers and plan detection and response accordingly.
⚡ What’s happening
A researcher known as Nightmare-Eclipse has released three proof-of-concept exploits targeting Microsoft Defender: BlueHammer, RedSun and UnDefend. Security firms including Vectra AI and Huntress have since observed signs of real-world exploitation.
The attacks leverage how Defender handles file remediation and classification, allowing adversaries to escalate privileges and interfere with core protection mechanisms. Huntress researchers observed targeted, hands-on-keyboard activity, with attackers staging binaries in low-noise directories and renaming files to evade detection to reduce visibility on tools like VirusTotal.
🔐 How the exploits work
BlueHammer (patched)
- Exploits a race condition (TOCTOU) in Defender’s signature update process
- Redirects file rewrite operations to attacker-controlled locations (Vectra.ai)
- Enables SYSTEM-level access without kernel exploitation (Vectra.ai)
- Mitigated in April patch (CVE-2026-33825)
RedSun (unpatched)
- Targets Defender’s TieringEngineService
- Triggered using an embedded EICAR test string
- Exploits remediation workflow to execute attacker code as SYSTEM (Vectra.ai)
- Works on fully patched Windows systems (Vectra.ai)
UnDefend (post-exploitation)
- Used after SYSTEM access is obtained
- Quietly disrupts Defender updates (Vectra.ai )
- Gradually reduces threat detection without triggering alerts (Vectra.ai)
🎯 Why you should care
The exploits undermine a core assumption in enterprise security that endpoint protection tools provide a reliable last line of defense. They show that:
- Native security controls can be used as an attack vector
- Fully patched systems remain vulnerable to some techniques
- Detection can be degraded without obvious failure signals
👉 Business impact: Increased risk of stealthy compromise, reduced visibility, and delayed incident response
🧩Behavioral trend
- Growing focus on abusing security tools rather than bypassing them similar to recent abuse of OAuth workflows and CI/CD pipelines
- Exploitation of race conditions and file-handling logic
- Increased targeting of endpoint detection and response (EDR) layers
📡What this suggests
Attackers are increasingly targeting the security stack itself, exploiting trusted tools and processes to gain privileged access and evade detection.
🛡 What to do
- Apply April patches immediately (for BlueHammer)
- Monitor for privilege escalation and abnormal SYSTEM-level activity
- Look for anomalies in Defender processes and update behavior
- Validate secondary detection layers beyond the primary EDR stack