BlueHammer: Microsoft Defender Exploited in Ransomware

Security researchers confirmed this week that CVE-2026-33825, a local privilege escalation vulnerability in Microsoft Defender tracked as BlueHammer, has moved from targeted exploitation to widespread use by ransomware operators. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a specific notation of ransomware campaign activity.

The vulnerability exists in Microsoft Defender's update process. Insufficient access control granularity allows an authenticated attacker to manipulate the Defender update mechanism, escalating from low-privilege local access to NT AUTHORITY\SYSTEM — the highest privilege level on Windows. Once at SYSTEM level, attackers can disable security tools, create persistent backdoors, and deploy ransomware payloads with impunity.

What makes BlueHammer particularly dangerous is its abuse of the security tool itself. By weaponizing Defender's trusted update pipeline, attackers bypass application control policies and EDR detection rules that would normally flag suspicious behavior. The attack chain has been observed in at least three ransomware families, with security vendor Cyderes documenting a full exploit chain from initial access through deployment.

Microsoft patched the vulnerability in its June 2026 Patch Tuesday release. However, organizations that have not applied the update — or that run legacy Defender builds on Windows Server systems — remain exposed. The BlueHammer exploit joins a growing list of security tool vulnerabilities including the earlier RedSun and UnDefend techniques that similarly target endpoint protection platforms.

For defenders, the takeaway is sobering: the tools designed to protect you can become the attack vector. Regular patching of security infrastructure is just as critical as patching the operating systems they protect.