One Researcher, Three Defender Zero-Days, 13 Days

What Happened

On April 3, 2026, a researcher posted working exploit code for a Windows Defender privilege escalation bug on GitHub. No warning. No coordinated disclosure. Just a working exploit and a note: "I was not bluffing Microsoft, and I'm doing it again" ^[1].

They weren't bluffing.

On April 16, two more Defender zero-days dropped. Same researcher. Same GitHub. Same message: Microsoft's disclosure process is broken, and publishing exploits is the only way to force a fix ^[2].

By April 17, security firm Huntress confirmed all three were being used in real attacks against real targets ^[3]. Attackers had combined two of the exploits into an attack chain: first disable Defender's update mechanism, then escalate to SYSTEM privileges. The result is full control of a Windows machine with security monitoring blinded.

The Three Bugs

BlueHammer (CVE-2026-33825), Patched

BlueHammer exploits a race condition in Defender's threat remediation engine. When Defender quarantines a file, BlueHammer uses a filesystem trick called an NTFS junction point to redirect Defender's write operation to a different location, like C:\Windows\System32. Defender writes the attacker's payload with SYSTEM privileges, thinking it's cleaning up a threat ^[4].

CVSS score: 7.8. Disclosed April 3. Weaponized April 10. Patched April 14. That's 11 days of exposure for every Windows machine on the planet.

RedSun, Unpatched

RedSun is another privilege escalation bug, but it abuses a different Defender feature: cloud file restoration. The attack tricks Defender into overwriting TieringEngineService.exe in System32 with an attacker-controlled binary. Then it triggers a Windows COM object to execute that binary as SYSTEM ^[5].

No CVE assigned. No patch. No public timeline from Microsoft. Works with near 100% reliability on fully patched systems.

UnDefend, Unpatched

UnDefend is the nastiest of the three, not because it escalates privileges, but because it blinds your security. It targets Defender's signature update pipeline and operates in two modes ^[2][3]:

• Passive mode: Silently blocks all Defender definition updates. Your threat detection freezes at whatever signatures were current when the exploit ran. New malware variants walk right past. And here's the kicker: Defender still reports itself as healthy to your EDR management console.
• Aggressive mode: Waits for a major Defender platform update, then exploits a condition to fully disable the engine.

No CVE assigned. No patch. No timeline.

How Attackers Are Using Them Together

Huntress documented the real-world attack chain on April 17 ^[3]. It starts with stolen FortiGate VPN credentials, a separate problem, but a common initial access vector. Then:

1. Reconnaissance: Hands-on-keyboard commands, whoami, cmdkey, net group, mapping the network like a human operator, not automated malware
2. Deploy UnDefend: Block Defender's signature updates. The security team's console still shows green checkmarks. Everything looks fine.
3. Deploy RedSun: Escalate from a standard user account to NT AUTHORITY\SYSTEM. Full administrative control.
4. Persist: Drop backdoors, harvest credentials, move laterally through the network. Defender can't see any of it because its definitions are frozen.

The two-step UnDefend-to-RedSun sequence is elegant in a way that should terrify you. First blind the guard dog, then walk through the front door with admin keys.

Why a Researcher Burned Three Zero-Days

Chaotic Eclipse didn't wake up one morning and decide to endanger every Windows user. This was a protest against Microsoft's Security Response Center (MSRC).

According to the researcher, MSRC required a video demonstration of the BlueHammer exploit as part of the disclosure process. They declined. MSRC allegedly dismissed the report ^[1][6].

Microsoft later said video demonstrations "are not a requirement for disclosure submissions", which raises the question of why the researcher was told otherwise ^[6].

Chaotic Eclipse isn't alone in their frustration. Dustin Childs of Trend Micro's Zero Day Initiative told Dark Reading that his organization has had "similar frustrations with the MSRC in the past, too," adding that he's "heard from more than one researcher who has said they don't work on Microsoft bugs anymore because the disclosure process is too frustrating" ^[6].

The researcher's blog post makes the motivation explicit: "Huge thanks to MSRC leadership for making this possible!!!" The sarcasm is doing a lot of work in that sentence ^[1].

Why This Matters for Surveillance

BlueHammer, RedSun, and UnDefend aren't spyware. They're something worse: they're the prerequisites for deploying spyware that nobody can detect.

SYSTEM-level access on a Windows machine means an attacker can:

• Install kernel-mode rootkits that survive reboots
• Dump every credential on the system using tools like Mimikatz
• Access the microphone and webcam without triggering user-visible indicators
• Deploy keyloggers below the operating system's visibility
• Intercept and exfiltrate network traffic

When you combine SYSTEM access (RedSun) with disabled security monitoring (UnDefend), you get the ideal conditions for persistent, undetectable surveillance. The target's IT team sees a healthy endpoint. The attacker sees everything.

This is the same general pattern, privilege escalation plus security bypass, that commercial spyware vendors and state-sponsored groups use. NSO Group's Pegasus, Intellexa's Predator, and the leaked US government hacking tools all depend on gaining elevated access and evading detection. These three Defender bugs hand both steps to anyone with a GitHub account.

What You Should Do

The Patch Gap

Microsoft patched BlueHammer on April 14, eleven days after disclosure. That's fast by Microsoft standards. But RedSun and UnDefend dropped on April 16 and remain unpatched as of April 19.

The next scheduled Patch Tuesday is May 13, nearly four weeks away. Multiple security firms have called for emergency out-of-band patches given confirmed active exploitation ^[3][7].

Microsoft hasn't assigned CVEs to RedSun or UnDefend, hasn't acknowledged them publicly, and hasn't provided a timeline for fixes. The official statement emphasizes the company's "commitment to investigate reported security issues" and its support for "coordinated vulnerability disclosure", a pointed reference to the researcher's uncoordinated disclosure that sidesteps the question of why the coordination failed in the first place ^[6].

Three billion people use Windows. Two of the three bugs that weaponize their antivirus software remain open. The exploit code is on GitHub. And the next patch cycle is four weeks out.

References

1. BleepingComputer, Disgruntled researcher leaks "BlueHammer" Windows zero-day exploit (April 3, 2026)
2. The Hacker News, Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched (April 17, 2026)
3. Help Net Security, Researcher drops two more Microsoft Defender zero-days, all three now exploited in the wild (April 17, 2026)
4. Picus Security, BlueHammer & RedSun: Windows Defender CVE-2026-33825 Zero-day Vulnerability Explained (April 2026)
5. Cyderes, RedSun Zero-Day: When Defender Becomes the Delivery Mechanism (April 2026)
6. Dark Reading, 'BlueHammer' Windows Exploit Signals Microsoft Disclosure Issues (April 2026)
7. gBlock, One Researcher Dropped Three Windows Defender Zero Days in 13 Days (April 2026)

Related Coverage

• Four Chrome Zero-Days in Four Months: Your Browser Is the Spyware Industry's Favorite Door, Another pattern of zero-day exploitation enabling surveillance
• US Government iPhone Hacking Tools Leaked to Criminals, What happens when government exploit tools escape controlled environments
• ICE Bought Paragon's Graphite Spyware. It Can Read Your Signal Messages., How commercial spyware exploits endpoint vulnerabilities
• An AI Found Zero-Days in Every Major OS, Anthropic's Mythos Preview and what AI-powered vulnerability discovery means for offense/defense balance