Three Microsoft Defender zero-days actively exploited by cyber threats

Microsoft Defender is at the center of a new wave of actively exploited vulnerabilities, with three zero-days emerging in just a few weeks. The latest two, dubbed "RedSun" and "UnDefend," join the previous "BlueHammer" (CVE-2026-33825), all published by a researcher known as Chaotic Eclipse and Nightmare Eclipse. Technical evidence shows that at least one threat group is already using these exploits in the wild.

Quick Response

  • Three zero-days in Microsoft Defender actively exploited
  • New exploits "RedSun" and "UnDefend" published after BlueHammer (CVE-2026-33825)
  • Attacks observed since April 10, with exploit dumps in user folders
  • Microsoft must release out-of-band patches before Patch Tuesday
  • Huntress has isolated the affected organization to limit damage

Technical details of the exploits

The "RedSun" exploit represents another privilege escalation vulnerability in the Microsoft Defender platform, while "UnDefend" allows a standard user to block signature updates or completely disable the service, especially in the case of major Defender updates. The researcher published the proofs of concept (PoC) on GitHub, despite Microsoft's warnings. The technical validity of RedSun has been confirmed by Will Dormann, a vulnerability analyst.

Timeline of vulnerabilities

The first exploit, "BlueHammer" (CVE-2026-33825), was made public on April 8, after an unsuccessful attempt at disclosure to the Microsoft Security Response Center. Microsoft released a patch on April 14, but the researcher published the new exploits on April 16. Researchers Zen Dodd and Yuanpei Xu, credited for reporting CVE-2026-33825, are not involved in the publication of these latest exploits.

Attacks observed in the wild

Huntress Labs detected the first use of BlueHammer on April 10, when Windows Defender blocked the exploit. On April 16, the same researchers observed the use of RedSun and UnDefend. The attackers placed the exploit files in the users' Pictures and Downloads folders, renaming them to avoid suspicion. Before launching the exploits, they executed commands to map user privileges, discover stored credentials, and the Active Directory structure.

Security implications

The situation requires urgent action from Microsoft. With the next Patch Tuesday still far away, it seems likely that the security team will release an out-of-band patch to address these critical vulnerabilities. Huntress has already isolated the affected organization to prevent further post-exploitation damage.

Mitigation tips

While waiting for an official patch, organizations can consider implementing additional security solutions, such as behavioral analysis and advanced threat monitoring. Furthermore, it is crucial to keep all systems up-to-date and apply security patches as soon as they become available. For a comprehensive security approach, it may be helpful to integrate advanced cybersecurity solutions that offer multi-layered protection against these emerging threats.

Impact on the cybersecurity landscape

These events highlight a concerning trend in the cybersecurity sector: the increase in exploits published before official patches are available. According to Recorded Future data, the number of published zero-days has increased by 35% in the last two years, with a particular peak in the first quarter of 2026. This phenomenon creates a security gap that cybercriminals quickly exploit, often with devastating consequences for unprepared organizations.

The critical role of out-of-band patches

The current situation underscores the strategic importance of out-of-band patches, released between traditional Patch Tuesdays. A Gartner report estimates that 40% of 2025 breaches were possible due to vulnerabilities for which patches already existed but had not yet been implemented. Microsoft, which has a history of releasing out-of-band patches when necessary, is now under pressure to act quickly and mitigate these risks.

Implications for vulnerability management

For IT security professionals, this situation underscores the importance of a proactive approach to vulnerability management. Implementing a structured vulnerability management program, which includes regular scanning, risk assessment, and patch prioritization, has become a critical necessity. Additionally, adopting advanced cybersecurity solutions that offer multi-layered protection can help bridge the gap between vulnerability discovery and patch release.

The importance of training and awareness

Another crucial aspect is end-user training. According to an IBM report, 95% of cybersecurity incidents are caused by human error. In this context, it is essential to educate users about the signs of cyberattacks and basic security practices, such as avoiding running unknown files downloaded from the internet. Continuous training and phishing attack simulations can significantly increase organizations' resilience.

Considerations for small and medium-sized businesses

Small and medium-sized businesses (SMBs) are particularly vulnerable in these situations, often due to limited resources and lack of specialized cybersecurity personnel. For these organizations, adopting managed security solutions (MSP) can provide a level of protection similar to that of large companies, without the need to invest in complex infrastructures. Additionally, joining security information sharing programs (ISAC) can provide valuable information on emerging threats and best practices for mitigation.

The future of cybersecurity

Looking ahead, we are likely to see an increase in automated exploits and the use of artificial intelligence by attackers. According to a Forrester report, by 2028, 70% of organizations will be victims of cyberattacks exploiting zero-day vulnerabilities. In response, the cybersecurity sector is already developing new technologies, such as machine learning-based anomaly detection systems and automated incident response solutions.

Preparing for the future

The current situation with Microsoft Defender serves as a representative sample of the challenges that the cybersecurity sector must face. For organizations, the key to resilience is a multi-phase approach that combines proactive vulnerability management, user training, adoption of advanced technologies, and information sharing. Only through collective and continuous commitment can we hope to keep up with the evolution of cyber threats.

Future outlook

Based on current trends, we can predict an increase in collaborations between security researchers, companies, and government agencies to address the zero-day threat. Additionally, new business models are likely to emerge in the cybersecurity sector, such as subscription services for priority patches and real-time information sharing platforms. Finally, the adoption of stricter security standards and the harmonization of regulations globally could become a priority to protect critical infrastructures and sensitive data.

Conclusions

As we navigate this evolving landscape, it is clear that cybersecurity requires a holistic and adaptive approach. Organizations that invest in advanced technologies, training, and collaboration will be better positioned to face future challenges and protect their digital assets. The current situation with Microsoft Defender is a powerful reminder of the importance of remaining vigilant and proactive in the world of cybersecurity.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the improper use of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.