Huntress researchers have identified active in-the-wild exploitation of three zero-day vulnerabilities in Microsoft Defender, dubbed BlueHammer, RedSun, and UnDefend. While BlueHammer (CVE-2026-33825) was addressed in the April 2026 Patch Tuesday updates, RedSun and UnDefend remain unpatched and are actively exploited to achieve system-level privileges and block security updates.
Vulnerability Details
Affected Product: Microsoft Defender [Windows 10, Windows 11, Windows Server 2019 and later]
Identifier: CVE-2026-33825 (BlueHammer); RedSun and UnDefend currently lack CVEs
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Critical urgency for patching BlueHammer; high vigilance required for the unpatched flaws.
Attack Vector: Attackers abuse Defender’s file remediation and cloud file rollback mechanisms using opportunistic locks (oplocks) and NTFS junction points to overwrite critical system binaries.
Ease of Exploit: Low complexity; Proof-of-Concept (PoC) exploits are publicly available on GitHub and actively used by threat actors.
Action Plan
Immediate Action: Apply the April 2026 Patch Tuesday updates to mitigate BlueHammer (CVE-2026-33825).
Workaround: Implement strict application control policies and restrict unauthorized executables to limit post-exploitation activities.
Detection: Monitor for anomalous Defender file write activity, specifically cldapi.dll operations targeting C:\Windows\System32, and flag oplock-assisted file redirection.
Relevant professional terms
Local Privilege Escalation (LPE)
An attack technique where a user with limited access rights exploits a vulnerability to gain higher-level permissions, such as SYSTEM or Administrator access, on a local machine.
Opportunistic Lock (Oplock)
A mechanism in Windows that allows a process to temporarily lock a file to manage concurrent access, which attackers can abuse to intercept and redirect file operations to privileged system locations.
A critical remote code execution vulnerability, tracked as CVE-2026-34197, in Apache ActiveMQ Classic is currently actively exploited in the wild. The 13-year-old flaw allows attackers to execute arbitrary OS commands and has prompted an urgent mandate from CISA for immediate remediation.
Vulnerability Details
Affected Product: Apache ActiveMQ Classic (versions prior to 5.19.4 and 6.2.3)
Identifier: CVE-2026-34197
CVSS Score: 8.8 (High)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Urgent - CISA mandates federal agencies to patch by April 30, 2026.
Attack Vector: Attackers exploit the Jolokia JMX-HTTP bridge API by invoking management operations to fetch a malicious remote configuration file, leading to arbitrary OS command execution.
Ease of Exploit: Moderate to Low barrier. While it typically requires authentication, default credentials (admin:admin) are widely used, and it can be chained with CVE-2024-32114 for unauthenticated exploitation on specific versions.
Action Plan
Immediate Action: Upgrade to Apache ActiveMQ Classic Version 5.19.4 or Version 6.2.3 immediately.
Workaround: Change default credentials (admin:admin) and restrict network access to the /api/jolokia/ endpoint.
Detection: Monitor broker logs for POST requests to /api/jolokia/ containing “addNetworkConnector”, unexpected outbound HTTP requests, and vm:// URIs with “brokerConfig=xbean:http”.
Relevant professional terms
Jolokia API
An HTTP-to-JMX bridge that exposes Java Management Extensions (JMX) MBeans via a REST interface, enabling remote management of Java applications and services.
Remote Code Execution (RCE)
A severe vulnerability that allows an attacker to run arbitrary malicious commands or code on a target machine over a network.
A critical vulnerability chain dubbed “NomShub” (CVE-2026-22708) in the Cursor AI code editor allows attackers to hijack developer machines via indirect prompt injection. The flaw has been patched by the vendor, but unpatched systems remain vulnerable to stealthy remote code execution simply by opening a malicious repository.
Vulnerability Details
Affected Product: Cursor AI code editor (versions prior to January 2026 patch)
Identifier: CVE-2026-22708
CVSS Score: Critical
Exploitation Status: Proof of Concept (PoC) Available
Risk & Impact
Triage: Immediate patching is required for all developers utilizing the Cursor AI environment.
Attack Vector: An indirect prompt injection is chained with a sandbox escape via shell built-ins, abusing Cursor’s remote tunnel feature to establish persistent access.
Ease of Exploit: Low complexity; the attack can be triggered with zero-click or one-click interaction simply by opening a malicious repository.
Action Plan
Immediate Action: Upgrade Cursor AI to the Latest Version (post-January 2026) to enforce explicit user approval for unclassified commands.
Workaround: Do not rely solely on allowlists; implement strict sandboxing and isolate environment variables between agent sessions.
Detection: Network detection is highly difficult as traffic routes through legitimate Microsoft Azure infrastructure. Monitor endpoints for unexpected shell built-in executions (e.g., export, typeset) and unauthorized tunnel registrations.
Relevant professional terms
Indirect Prompt Injection
A vulnerability where an AI system processes malicious instructions hidden in external data sources (like a repository’s README file) rather than directly from the user, causing the AI to execute unintended actions.
Sandbox Bypass
A technique used by attackers to escape a restricted, isolated execution environment (sandbox) to gain broader access to the host operating system or file system.
Dragon Boss Solutions, a known adware vendor, pushed a malicious update to over 25,000 endpoints globally. The payload systematically disabled major antivirus products and established deep persistence, creating a massive supply chain vulnerability.
Key TTPs
Initial Access: Supply chain compromise via a trusted update mechanism in signed adware.
Execution: Deployed MSI packages and a PowerShell script (ClockRemoval.ps1) running with SYSTEM privileges.
Defense Evasion: Disabled AV services, modified hosts files to block AV updates, and added Windows Defender exclusions.
Campaign Analysis
What began as an annoying browser-hijacking PUP evolved into a severe system-level threat capable of deploying ransomware. The threat actor left their primary update domain unregistered, exposing thousands of systems to potential takeover before researchers sinkholed it.
Targeting & Infrastructure
Target Profile: Global organizations and individuals across five continents (over 25,000 endpoints).
Infrastructure: Abused legitimate code-signing certificates and an unregistered update domain.
PUP (Potentially Unwanted Program): Software that a user may perceive as unnecessary, often bundled with legitimate programs and exhibiting adware-like behavior.
Sinkholing: A defensive technique where malicious traffic is redirected to a controlled server to prevent it from reaching its intended destination.
ZionSiphon is a newly discovered OT-focused malware designed to sabotage Israeli water treatment and desalination plants. The malware attempts to manipulate ICS protocols to dangerously increase chlorine levels and water pressure.
Key TTPs
Initial Access: Spreads via USB removable media, creating malicious shortcut files to trick users.
Execution: Escalates privileges via RunAsAdmin() and modifies local ICS configuration files to alter chlorine doses.
Defense Evasion: Masquerades as svchost.exe, establishes persistence via registry keys, and includes a self-destruct mechanism.
Campaign Analysis
Though currently in a developmental phase, ZionSiphon represents a dangerous shift toward politically motivated cyber-physical attacks. It demonstrates that OT sabotage capabilities are no longer exclusive to highly resourced nation-states.
Targeting & Infrastructure
Target Profile: Israeli critical infrastructure, specifically water treatment and desalination facilities.
Infrastructure: Scans local subnets for ICS protocols like Modbus, DNP3, and S7comm to communicate with PLCs.
Relevant Terms
Operational Technology (OT): Hardware and software that detects or causes a change through the direct monitoring and control of physical devices.
Modbus: A standard industrial communication protocol used for transmitting information between electronic devices.
Russian state-sponsored threat actor APT28 compromised over 170 email accounts belonging to Ukrainian prosecutors and investigators. The cyber-espionage campaign exploited vulnerabilities in the Roundcube webmail platform to steal sensitive information.
Key TTPs
Initial Access: Spear-phishing emails delivered to targeted Roundcube webmail inboxes.
Execution: Zero-click exploitation of Roundcube vulnerabilities, executing malicious code when victims simply open an email.
Campaign Analysis
Tracked by CERT-UA since 2023, this long-running espionage operation highlights the GRU’s persistent focus on Ukraine’s legal bodies. The stolen data is likely intended to support Russian disinformation campaigns and discredit state institutions.
Targeting & Infrastructure
Target Profile: Ukrainian prosecutors, investigators, and local government agencies.
Commercial AI Automates Zero-Day Exploit Generation
Executive Summary
A new Forescout study reveals that commercial AI models have drastically improved in offensive capabilities, with half now able to autonomously generate working exploits.
Key Findings
100% of tested AI models now complete vulnerability research tasks, with 50% autonomously generating working exploits.
Top models like Claude Opus 4.6 and Kimi K2.5 no longer require complex prompts, lowering the barrier for novice attackers.
Using the RAPTOR framework, AI discovered four new zero-days in OpenNDS, including flaws previously missed by human analysts.
The Bottom Line
The democratization of exploit development fundamentally compresses the timeline between vulnerability discovery and weaponization. As AI transitions from assisting hackers to autonomously exploiting zero-days, organizations can no longer rely on traditional patch management. Security teams must pivot toward proactive, AI-driven defenses and assume continuous exposure.
Relevant Terms
Zero-Day Vulnerability: A software flaw unknown to the vendor, meaning no patch exists and attackers can exploit it immediately.
Agentic Framework: An AI system designed to pursue complex goals autonomously, making decisions and executing tasks without constant human prompting.
