TL;DR

Three Microsoft Defender zero-days are active right now. BlueHammer (CVE-2026-33825) — patched this April Patch Tuesday — lets any local user chain five legitimate Windows features into a SYSTEM shell, using Defender's own Volume Shadow Copy workflow to extract NTLM hashes without touching malware. RedSun (LPE, no CVE yet, unpatched) and UnDefend (DoS/blocks definition updates, unpatched) have functioning PoCs in the wild. Huntress has confirmed all three actively exploited. Meanwhile, Unit 42's Zealot research demonstrates that autonomous AI attackers can chain endpoint compromise with GCP/AWS metadata credential theft and data exfiltration in fully automated attack loops — at speeds no human SOC can match without machine-speed detection. This playbook tells you exactly what to hunt, what to block, and how to respond before the AI attacker's second loop.

---

Background: The Defender Paradox

Windows Defender is installed on approximately 1.8 billion Windows endpoints worldwide. Its presence is assumed, its trust is total: it runs as NT AUTHORITY\SYSTEM, it communicates with cloud telemetry pipelines, it creates Volume Shadow Copies for forensic scanning, and it is among the last processes any security model would flag as suspicious. That trust is exactly what BlueHammer, RedSun, and UnDefend exploit.

The vulnerability class is deceptively mundane — insufficient granularity of Access Control Lists (ACLs) on Defender's internal configuration paths, registry keys, and service interfaces. No memory corruption. No network access required. Just ACLs that include Users or low-privilege groups where only SYSTEM and Administrators should appear. The result: a documented SYSTEM escalation that a standard domain user can execute with a few lines of PowerShell, using only Windows-native APIs.

When PoC author "Chaotic Eclipse" (also "Nightmare Eclipse") published the BlueHammer exploit on GitHub on April 8th — initially describing it as "buggy" — the security community fixed it within days. By April 22nd, Huntress was tracking active in-the-wild exploitation [1].

---

Technical Analysis

BlueHammer (CVE-2026-33825): The Five-Step SYSTEM Chain

The BlueHammer attack chain is elegant in its brutality. Cyderes' Howler Cell team reverse-engineered and reproduced it cleanly [2]:

Step 1 — Force VSS Snapshot via Defender. Defender's scan engine can be manipulated by a low-privilege user to trigger creation of a Volume Shadow Copy. This leverages Defender's legitimate scan-scope workflow — nothing anomalous in the process list.

Step 2 — Race the Cleanup Window. Immediately after the VSS snapshot is created, the exploit pauses Defender's cleanup at a precise timing window (timing dependent on system load; PoC retries automatically). During this window, the shadow copy contains accessible registry hive files — including SAM, SYSTEM, and SECURITY — that are ordinarily locked.

Step 3 — Extract NTLM Hashes. The shadow copy path (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyX\Windows\System32\config\SAM) is read before Defender resumes cleanup. NTLM password hashes for all local accounts — including Administrator — are extracted and decrypted offline.

Step 4 — Token Duplication → SYSTEM. The exploit uses the extracted hash to authenticate locally, duplicates the Administrator's security token, assigns it SYSTEM integrity level, and calls CreateService to spawn a transient Windows service. That service executes a cmd.exe as NT AUTHORITY\SYSTEM in the current user session.

Step 5 — Cover Tracks. The local Administrator's NTLM hash is restored to its original value via SamrChangePasswordUser. From the user's perspective, nothing changed. From the AD/SIEM perspective, there was no failed logon, no new account, no unexpected process elevation in a traditional sense.

Critically, Cyderes confirmed: the April 2026 Patch Tuesday fix only addresses the original PoC binary's hash signature. A simple recompile defeats the signature entirely. The underlying VSS-timing technique remains partially viable until a deeper ACL remediation is applied.

RedSun: A Second Unpatched LPE Vector

RedSun follows a different ACL exploitation path targeting Defender's service control permissions. Where BlueHammer abuses the scan workflow, RedSun directly modifies service binaries or configuration paths accessible to low-privilege users — achieving the same SYSTEM escalation but without the VSS dependency. Full technical details are embargoed pending Microsoft response, but PoCs are circulating privately and Huntress has confirmed exploitation in post-compromise scenarios [3].

UnDefend: The Blind-Spot Maker

UnDefend does not escalate privileges — it weaponizes Defender's update mechanism against itself. By triggering a DoS condition against the definition update pipeline, an attacker can silently prevent Defender from receiving new signatures. The endpoint appears healthy in management consoles (Defender "running," no errors reported to MDE), but its knowledge base may be days or weeks stale. This is a force multiplier: deploy UnDefend first to freeze AV definitions, then deploy payloads that newly-published signatures would otherwise catch.

The AI Dimension: Unit 42 Zealot and Machine-Speed Chaining

Unit 42's "Zealot" research (April 23, 2026) demonstrated that LLM-based multi-agent systems can autonomously execute cloud attack chains that previously required skilled human operators [4]. The Zealot architecture deploys three specialist agents — Infrastructure, Application Security, and Cloud Security — coordinated by a supervisor. In sandbox testing against a misconfigured GCP environment, Zealot autonomously chained:

1. SSRF exploitation against an internal web service

2. GCP IMDS credential theft (http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/) using the stolen request context

3. Service account impersonation via stolen OAuth tokens

4. BigQuery data exfiltration through the GCP storage APIs

Total dwell time from initial foothold to exfil: minutes. Human SOC dwell time to detect: historically 21 days (IBM X-Force 2025 baseline). The operational implication for the BlueHammer cluster is direct: an AI attacker that lands a credential-harvesting implant via phishing can use Zealot-style automation to immediately attempt cloud credential theft from the compromised endpoint's environment variables, browser credential stores, and developer tool configs — before any analyst has reviewed the initial alert.

---

IOCs / Indicators

BlueHammer Behavioral IOCs (hunt for these even after patching)

| Indicator | Data Source | MITRE ATT&CK |

|-----------|-------------|--------------|

| VSS snapshot created by non-SYSTEM user-space process | Windows Security Event 8224 / VSS operational log | T1003.002 (OS Credential Dumping: Security Account Manager) |

| Cloud Files sync root registration from low-privilege account | Windows event log, MDE | T1543.003 (Create/Modify System Process: Windows Service) |

| CreateService call from non-administrative session | Sysmon Event 6 (Driver Load) / 7, Security 7045 | T1543.003 |

| Local Administrator NTLM hash change + restore within <60s | Windows Security 4723, 4724 | T1003.002 |

| Registry reads on HKLM\SAM\SAM\Domains\Account\Users from non-SYSTEM process | Sysmon Event 13 | T1003.002 |

| Shadow copy path access: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy*\Windows\System32\config\ | File audit logs, MDE | T1003.002 |

UnDefend IOCs

| Indicator | Data Source |

|-----------|-------------|

| Defender definition version unchanged for >24h while network-connected | MDE / Defender console |

| MpCmdRun.exe returning update failures silently | MDE telemetry, Get-MpComputerStatus.AntivirusSignatureLastUpdated |

| DNS query failures to .wdcp.microsoft.com or .wd.microsoft.com | DNS logs |

Zealot-style AI Cloud Attack IOCs

| Indicator | Data Source |

|-----------|-------------|

| IMDS endpoint access (169.254.169.254 or metadata.google.internal) from user-land process | Cloud VPC flow logs |

| Sudden IAM role assumption/service account token exchange shortly after SSRF | CloudTrail, GCP Audit Logs |

| BigQuery/S3/GCS read operations from new source IP or service account not previously seen | CloudTrail Data Events |

| LLM API calls from compromised endpoint to OpenAI/Anthropic endpoints | Proxy/DLP logs |

---

Lyrie Take

The three-vector Defender compromise represents a structural shift: the most trusted process on every Windows machine is now an attack surface. The BlueHammer chain doesn't look like an attack — it looks like Defender doing its job (scanning, creating VSS, interacting with services). This is precisely why behavioral detection beats signature detection here. The original PoC binary's signature is caught; a recompiled version is not. A behavioral rule on "VSS creation from user-space followed by SAM registry read" catches both.

UnDefend is the more insidious threat long-term. An endpoint running stale definitions is a blind spot in your EDR estate — not a failed device, not a flagged device. Just an invisible hole. At machine scale, an AI attacker deploying UnDefend across 50 endpoints simultaneously creates a coordinated blind-spot window faster than any human SOC can triage.

The Unit 42 Zealot findings reframe the urgency: these vulnerabilities are not just relevant to patient human attackers who need post-compromise access. They are exactly the class of technique that autonomous AI attackers enumerate systematically from initial access — because they're documented, they work, and they require no zero-day capability of their own. Lyrie operates at the same speed as the attacker. Signature-reliant AV does not.

---

Defender Playbook

Immediate (0–24h)

1. Verify BlueHammer patch status.

# Check Defender platform version — patched ≥4.18.2504.x
Get-MpComputerStatus | Select-Object AMProductVersion, AntivirusSignatureLastUpdated

Target: April 2026 Patch Tuesday or later Windows Update applied on all endpoints.

2. Audit Defender ACLs.

# Check for over-permissive ACLs on Defender config paths
icacls "C:\ProgramData\Microsoft\Windows Defender" /T | findstr /i "users\|everyone\|authenticated"

Only SYSTEM, TrustedInstaller, and Administrators should hold write access.

3. Deploy VSS + SAM access hunting rule (Sysmon + SIEM).

<!-- Sysmon config: alert on shadow copy SAM access from non-SYSTEM -->
<RawAccessRead onmatch="include">
  <TargetObject condition="contains">HarddiskVolumeShadowCopy</TargetObject>
</RawAccessRead>

Pair with correlation: alert if same PID also accessed HKLM\SAM within 300 seconds.

4. Monitor Defender definition age actively.

# Flag if signature age > 24h during working hours
$status = Get-MpComputerStatus
if ((Get-Date) - $status.AntivirusSignatureLastUpdated -gt [TimeSpan]::FromHours(24)) {
    Write-Warning "STALE DEFINITIONS — potential UnDefend or update failure"
}

Automate via RMM/Intune compliance policy.

Short-term (24–72h)

5. Restrict VSS access at policy level. Apply AppLocker or Windows Defender Application Control (WDAC) rules blocking vssvc.exe and vshadow.exe invocation from non-administrative contexts.

6. Enable LocalAccountTokenFilterPolicy = 0. Prevent token duplication across local admin sessions:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
LocalAccountTokenFilterPolicy = 0

7. Enable LAPS (Local Administrator Password Solution). Randomize local admin passwords per machine. BlueHammer's hash-restore trick becomes useless when each local admin password is unique and rotated.

8. Cloud credential detection (for Zealot-class post-exploitation). In CloudTrail/GCP Audit Logs, alert on: service account token generation from an IP not previously associated with that identity, + any IMDS endpoint query from a user-land process (not from instance metadata service itself).

Ongoing

9. Hunt for RedSun indicators. Until patched: audit service ACLs on all Defender-related services. Use sc sdshow WinDefend, sc sdshow WdNisSvc, sc sdshow Sense and flag any AU (Authenticated Users) entries with write-equivalent permissions.

10. Assume AI-assisted post-exploitation. Any endpoint compromise today should be treated as potentially automated lateral movement within minutes — not hours. Incident response timelines must be compressed accordingly. Initial triage → isolation should be an automated response, not a human-in-loop ticket.

---

Sources

1. Huntress Labs — "Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched," The Hacker News, April 2026. https://thehackernews.com/2026/04/three-microsoft-defender-zero-days.html

2. Rahul Ramesh & Reegun Jayapaul (Cyderes Howler Cell) — BlueHammer Technical Analysis, Cyderes Blog, April 2026. https://www.cyderes.com/howler-cell/windows-zero-day-bluehammer

3. Zeljka Zorz — "BlueHammer: Windows zero-day exploit leaked," Help Net Security, April 8, 2026. https://www.helpnetsecurity.com/2026/04/08/bluehammer-windows-zero-day-exploit-leaked/

4. Yahav Festinger & Chen Doytshman (Unit 42) — "Can AI Attack the Cloud? Lessons From Building an Autonomous Cloud Offensive Multi-Agent System," Palo Alto Networks Unit 42, April 23, 2026. https://unit42.paloaltonetworks.com/autonomous-ai-cloud-attacks/

5. CVE.news — "CVE-2026-33825 — Elevate Privileges Using Access Control Flaws in Microsoft Defender," April 2026. https://www.cve.news/cve-2026-33825/

6. Microsoft MSRC — CVE-2026-33825 Advisory. https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2026-33825

7. SecurityWeek — "Recent Microsoft Defender Vulnerability Exploited as Zero-Day," April 2026. https://www.securityweek.com/recent-microsoft-defender-vulnerability-exploited-as-zero-day/

---

Lyrie Verdict: Three Defender zero-days, two unpatched, one only signature-patched (recompile bypasses it). Machine-speed AI attackers chain this class of LPE to cloud credential theft in automated loops. Signature AV is fighting last month's battle. Behavioral detection and autonomous response are the only tools operating at attacker speed.

Lyrie.ai Cyber Research Division — Senior Analyst Desk