Executive Summary<\/p>\n
In April 2026, two critical zero-day vulnerabilities\u2014RedSun\u00a0and UnDefend\u2014were discovered in Microsoft Defender, the default endpoint protection suite for Windows 10, Windows 11, and Windows Server\u00a0platforms. These vulnerabilities are being actively exploited in the wild, enabling attackers to escalate privileges to SYSTEM and to degrade or disable Defender\u2019s protection mechanisms. While Microsoft\u00a0has released a patch for the related BlueHammer\u00a0(CVE-2026-33825) vulnerability, both RedSun\u00a0and UnDefend\u00a0remain unpatched as of this report. The exploitation of these flaws allows adversaries to bypass core endpoint defenses, establish persistent access, and facilitate lateral movement or ransomware deployment. This advisory provides a technical breakdown of the vulnerabilities, observed attacker tactics, detection guidance, and actionable mitigation strategies.<\/p>\n
Threat Actor Profile<\/p>\n
The exploitation of RedSun\u00a0and UnDefend\u00a0has been observed in attacks attributed to advanced threat actors and ransomware operators. While no specific Advanced Persistent Threat (APT) group has been publicly linked to these campaigns, the sophistication of the exploitation chains, the use of manual post-exploitation techniques, and the rapid weaponization of public proof-of-concept (PoC) code suggest involvement by actors with significant technical capability and operational maturity. The threat landscape includes financially motivated ransomware groups, initial access brokers, and potentially state-sponsored entities seeking to establish stealthy persistence on high-value targets. The observed Tactics, Techniques, and Procedures (TTPs) align with those used by groups specializing in privilege escalation, defense evasion, and endpoint security bypass.<\/p>\n
Technical Analysis of Malware\/TTPs<\/p>\n
RedSun\u00a0is a local privilege escalation vulnerability that abuses a logic flaw in Microsoft Defender\u2019s\u00a0remediation process for files tagged as cloud files (leveraging the Windows Cloud Files API). When Defender detects a malicious file in a user-writable directory (such as Downloads\u00a0or Pictures), it attempts to remediate by rewriting the file. Attackers exploit this by creating NTFS directory junctions (reparse points) and opportunistic locks (oplocks) to redirect Defender\u2019s privileged write operation to protected system locations, such as C:\\Windows\\System32\\TieringEngineService.exe. This enables a low-privileged user to overwrite critical system binaries with attacker-controlled payloads, achieving SYSTEM-level code execution without requiring kernel exploits or administrative rights.<\/p>\n
UnDefend\u00a0is a Defender degradation vulnerability that allows a local attacker to block or disrupt Defender\u2019s signature and engine updates. By manipulating update mechanisms or leveraging file system tricks, an attacker can cause Defender to appear operational while it is, in fact, outdated and ineffective. This enables adversaries to maintain stealthy persistence post-compromise, as Defender will not detect or remediate subsequent malicious activity.<\/p>\n
Attackers typically drop exploit binaries with innocuous names (such as RedSun.exe or FunnyApp.exe) into user-writable directories. The exploitation chain often begins with initial access via phishing, credential theft, or exploitation of remote access solutions, followed by local execution of the exploit to escalate privileges and disable or degrade Defender. Manual post-exploitation actions include credential dumping, lateral movement, and deployment of ransomware or other payloads.<\/p>\n
Exploitation in the Wild<\/p>\n
Active exploitation of RedSun\u00a0and UnDefend\u00a0was first confirmed in mid-April 2026, shortly after public PoC code was released on GitHub. Managed Detection and Response (MDR) providers, including Huntress Labs, have observed real-world intrusions where attackers leveraged these vulnerabilities to gain SYSTEM privileges and disable endpoint protection. Attackers commonly stage exploit binaries in user-writable folders, execute them to gain elevated access, and then use UnDefend\u00a0techniques to prevent Defender from receiving updates, ensuring continued evasion of detection.<\/p>\n
Reports indicate that attackers are chaining these vulnerabilities: first exploiting RedSun\u00a0to achieve SYSTEM access, then deploying UnDefend\u00a0to degrade Defender\u2019s effectiveness. This chaining enables persistent, stealthy control over compromised endpoints. The exploitation has been observed in enterprise environments, with attackers targeting both workstations and servers.<\/p>\n
Victimology and Targeting<\/p>\n
The primary targets of these attacks are organizations running Windows 10, Windows 11, or Windows Server 2019\/2022\u00a0with Microsoft Defender Antivirus\u00a0real-time protection enabled. Sectors observed to be at risk include finance, healthcare, government, education, and critical infrastructure, as well as managed service providers (MSPs) and their downstream clients. The vulnerabilities are exploitable on any supported Windows system with Defender enabled and the standard cldapi.dll present. Attackers are opportunistically targeting organizations with exposed endpoints, weak credential hygiene, or insufficient monitoring of endpoint security events.<\/p>\n
Mitigation and Countermeasures<\/p>\n
Organizations should immediately apply the latest Microsoft Defender\u00a0updates to address the patched BlueHammer\u00a0(CVE-2026-33825) vulnerability. However, as RedSun\u00a0and UnDefend\u00a0remain unpatched, additional mitigations are required. Security teams should monitor for Defender-initiated SYSTEM-level process execution, Defender update failures, and execution of binaries from user-writable directories. Restricting execution from directories such as Downloads, Pictures, and Temp\u00a0can reduce the attack surface. Enforcing Attack Surface Reduction (ASR) rules\u00a0and increasing alerting for Defender tampering or abnormal remediation activity are recommended. Supplementing Defender with a secondary Endpoint Detection and Response (EDR) solution capable of detecting Defender bypasses can provide additional protection. Running Defender in passive mode, with an alternative real-time protection solution, may be advisable in high-risk environments. Enabling Defender tamper protection and auditing event logs for privileged service executions from user-writable paths can help detect exploitation attempts. Organizations should prepare for out-of-band patches from Microsoft and maintain heightened vigilance for related threat activity.<\/p>\n
ReferencesAbout Rescana<\/p>\n
Rescana\u00a0is a leader in Third-Party Risk Management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their supply chain and digital ecosystem. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help strengthen your organization\u2019s cyber resilience, please contact us at ops@rescana.com.<\/p>\n","protected":false},"excerpt":{"rendered":"Executive Summary In April 2026, two critical zero-day vulnerabilities\u2014RedSun\u00a0and UnDefend\u2014were discovered in Microsoft Defender, the default endpoint protection…\n","protected":false},"author":2,"featured_media":460753,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-460752","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/460752","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=460752"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/460752\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/460753"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=460752"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=460752"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=460752"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}