Microsoft Windows flaws exploited after researcher publishes code

According to cybersecurity firm Huntress, hackers have broken into at least one organization over the last two weeks by taking advantage of three Windows security flaws. All three vulnerabilities affect the Microsoft-made antivirus Windows Defender, allowing a hacker to gain high-level or administrator access to an affected Windows computer. On Friday, Huntress posted on X that the security flaws being exploited are:

• BlueHammer
• UnDefend
• RedSun

It appears that the hackers are exploiting the bugs by using exploit code that a security researcher, who goes by Chaotic Eclipse, published online.

Of the three vulnerabilities, Microsoft has patched only BlueHammer so far, leaving UnDefend and RedSun unpatched and exposed. Chaotic Eclipse published the code to exploit all three vulnerabilities on their GitHub page. The researcher alluded to a conflict with Microsoft as the motivation behind publishing the code. “I was not bluffing Microsoft and I’m doing it again,” Chaotic Eclipse wrote, adding a thank you to the leadership of the Microsoft Security Response Center (MSRC), the company’s team that investigates cyberattacks and handles reports of vulnerabilities.

This situation represents a case of full disclosure, an industry practice where researchers report flaws to software makers to help them fix them before public disclosure. When communication between researchers and vendors fails, researchers sometimes publish proof-of-concept code capable of abusing the bug, which can then be used by hackers for attacks.

The exploitation of these unpatched flaws has created challenges for security teams. John Hammond, a researcher at Huntress, warned that the public availability of these exploits has created a tug-of-war match between defenders and cybercriminals. Hammond noted that because the tools are easily available and already weaponized, defenders must race against their adversaries, frantically trying to protect systems against ill-intended actors who rapidly take advantage of these exploits as ready-made attacker tooling.

Why it matters

This incident illustrates the volatility of full disclosure when communication between researchers and vendors fails, turning unpatched bugs into immediate, weaponized threats for organizations.