InfoSecBulletin Cybersecurity for mankind
Threat actors are exploiting 3 new Windows security flaws in their attacks to get SYSTEM or higher administrator access. Since the beginning of the month, a security expert called “Chaotic Eclipse” or “Nightmare-Eclipse” has shared proof-of-concept exploit code for all three security problems.
Two of the flaws, called BlueHammer and RedSun, are in Microsoft Defender that let a user gain more privileges. The third one, named UnDefend, lets a regular user stop updates for Microsoft Defender.
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
At the time of the leak, the security flaws these exploits targeted were considered zero-days by Microsoft’s definition, since they had no official patches or updates to address them.
Huntress Labs security researchers saw all three zero-day exploits being used in real life on Thursday. The BlueHammer flaw has been used since April 10.
They also spotted UnDefend and RedSun exploits on a Windows device that was breached using a compromised SSLVPN user, in attacks showing evidence of “hands-on-keyboard threat actor activity.”
“The Huntress SOC is observing the use of Nightmare-Eclipse’s BlueHammer, RedSun, and UnDefend exploitation techniques,” the researchers said.
Patch Status and Mitigations:
Attackers can use the RedSun exploit to get SYSTEM privileges on Windows 10, Windows 11, and Windows Server 2019 and newer. This can happen when Windows Defender is on, even after the April Patch Tuesday updates.
“When Windows Defender realizes that a malicious file has a cloud tag, for whatever stupid and hilarious reason, the antivirus that’s supposed to protect decides that it is a good idea to just rewrite the file it found again to it’s original location,” the researcher explained. “The PoC abuses this behaviour to overwrite system files and gain administrative privileges.”
“Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers as soon as possible,” a Microsoft spokesperson told Bleeping Computer earlier this week when contacted for more information on the disclosure issues reported by the anonymous researcher.
“We also support coordinated vulnerability disclosure, a widely adopted industry practice that helps ensure issues are carefully investigated and addressed before public disclosure, supporting both customer protection and the security research community.”
