Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Cybersecurity: Threats and Defences
5SEP

BlueHammer turns into a ransomware step

2 min read
12:09UTC

CISA confirmed ransomware gangs are weaponising BlueHammer, the April Windows Defender flaw, to seize SYSTEM rights before deploying their encryptors.

← Back to Four privileged platforms under live attackJump to analysis ↓
TechnologyDeveloping
Key takeaway

A patched April flaw in Windows Defender is now a live SYSTEM-access step for ransomware crews.

CISA updated the Known Exploited Vulnerabilities (KEV) entry for CVE-2026-33825, the Windows Defender local-privilege-escalation (LPE) flaw known as BlueHammer, to confirm that ransomware gangs now exploit it for SYSTEM-level access before deploying encryptors. Microsoft patched the flaw on 14 April and CISA listed it on 22 April. It was disclosed by a researcher using the handle Chaotic Eclipse, whose run of Microsoft bugs produced a fifth unpatched zero-day last month.⁠1

The flaw works as a time-of-check-to-time-of-use race in Defender's remediation engine: the software checks a file's status, then acts on it a moment later, and an attacker swaps the target in between. On its own an LPE does nothing. Chained after an initial break-in, it hands an attacker the SYSTEM rights needed to switch off defences and encrypt at will. That is why the update matters: it turns a three-month-old patch that many programmes deprioritised into a live step in a working ransomware chain.

Deep Analysis

In plain English

Windows Defender is the built-in security software that comes free with Windows and is meant to stop malware. Researchers found a flaw in it that lets someone who has already broken into a computer, through some other route, use Defender itself to take full control of the machine, the highest level of access there is. CISA now says ransomware gangs are using this trick before locking victims' files, which is unsettling because the tool that is supposed to protect the computer has become part of the attack. A researcher who goes by the handle Chaotic Eclipse found the flaw; that same person has found several other serious Windows bugs this year.

Deep Analysis
Root Causes

Windows Defender's kernel-mode components run with system-level trust by design, which is precisely why compromising the security product itself hands a ransomware crew system-level access that a bug in an ordinary, already-restricted application cannot.

Chaotic Eclipse, the same handle already credited with a fifth zero-day disclosure this year, appears to work through private broker or bug-bounty channels rather than Microsoft's own coordinated-disclosure programme. The gap between a privately attributed find and CISA's public 'now confirmed exploited' update suggests BlueHammer circulated in criminal channels before any public patch timeline closed it.

What could happen next?
  • Risk

    Organisations that rely on Windows Defender as their primary endpoint protection now face a scenario where the protection layer itself can be turned against them at the privilege-escalation stage of an intrusion.

  • Meaning

    CISA's decision to update rather than newly list the entry signals the flaw was already tracked before ransomware use was confirmed, suggesting future KEV updates on existing entries deserve the same attention as new listings.

Sources:BleepingComputer
Mentions:CISA →CVE-2026-48172 →Windows Defender →Microsoft →Known Exploited Vulnerabilities →
First Reported In

Update #9 · FortiBleed harvest linked to Lynx crew

BleepingComputer· 4 Jul 2026
Read original →
Causes and effects
Caused by
A handle keeps dropping MS zero-days
The Chaotic Eclipse zero-day lineage that produced a fifth unpatched Microsoft flaw precedes BlueHammer's confirmed ransomware weaponisation.
Occurred 17 Jun 2026
Read story →
This Event
BlueHammer turns into a ransomware step
A patch many teams deprioritised in April has become a confirmed rung in the ransomware kill chain.
Different Perspectives
Hospital Sírio-Libanês
Hospital Sírio-Libanês
Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.
The Foschini Group
The Foschini Group
The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.
FirstVDS
FirstVDS
FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.
ESET
ESET
ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.
JPCERT/CC
JPCERT/CC
JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.
Cyber Security Agency of Singapore
Cyber Security Agency of Singapore
The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.