INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

BlueHammer Exploited Windows Flaw in Ransomware Attacks

| 2026-07-01 11:26 CRITICAL HIGH
JSON
Executive Summary AI-generated
The BlueHammer ransomware attack has been linked to a critical vulnerability in Microsoft Defender, CVE-2026-33825. This vulnerability allows attackers to elevate their privileges within the system and take control of systems with SYSTEM-level access. The attack was first detected on July 1st, but its use by ransomware groups has increased urgency for Windows users to update their devices. Experts warn that this vulnerability can be exploited through phishing, compromised credentials, or other means, allowing attackers to gain unauthorized access and potentially steal sensitive information.
Technical Mitigations AI-generated
Aquí te presento 3-5 technical mitigations para protegerse contra el ataque de ransomware utilizando BlueHammer: * Actualizar los sistemas Windows a la última versión disponible, especialmente si aún se utilizan dispositivos que no han sido actualizados. * Utilizar software antivirus y firewall para bloquear cualquier solicitud o acceso no autorizado al sistema. * Implementar políticas de seguridad robustas en el equipo, como autenticación biométrica o biometría, y asegurarse de que los usuarios tengan permisos adecuados para acceder a recursos críticos. * Utilizar herramientas de cifrado seguras y actualizadas, como BitLocker o Windows Defender Firewall con Advanced Security, para proteger la información sensible en el equipo. * Realizar copias de seguridad regulares de los datos importantes y mantenerlos fuera del sistema principal durante las operaciones de ransomware.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-33825CVE-2026-33825
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎April 2026
Threat actors used a known vulnerability in the BlueHammer ransomware to target Microsoft systems.
‎April 10, 2026
Attackers used BlueHammer starting April 10, 2026.
organisation RedSun
Attackers used BlueHammer starting April 10, 2026, then followed with RedSun and UnDefend proof-of-concept exploits on April 16.
‎April 14
Microsoft patched the vulnerability on April 14 as part of the April 2026 Patch Tuesday.
‎April 16
Attackers used BlueHammer starting April 10, 2026, exploited a flaw in the software then followed with proof-of-concept exploits on RedSun.
organisation RedSun
Attackers used BlueHammer starting April 10, 2026, then followed with RedSun and UnDefend proof-of-concept exploits on April 16.
‎April 22
The CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities catalog on April 22.
tactic Ransomware
CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities catalog on April 22 and later updated the entry to note ransomware use.
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution Known Exploited
CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities catalog on April 22 and later updated the entry to note ransomware use.
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
tactic T1588.006 - Vulnerabilities
CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities catalog on April 22 and later updated the entry to note ransomware use.
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
vulnerability CVE-2026-33825
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution BlueHammer
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
infrastructure Windows
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution KEV
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution Federal Civilian Executive Branch
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution FCEB
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution CVE-2026
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
‎May 7
Ransomware gangs began exploiting the BlueHammer flaw in Windows systems on April 22.
tactic Ransomware
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
vulnerability CVE-2026-33825
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution BlueHammer
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution Known Exploited
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
tactic T1588.006 - Vulnerabilities
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
infrastructure Windows
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution KEV
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution Federal Civilian Executive Branch
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution FCEB
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
attribution CVE-2026
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
‎June 2026
Microsoft fixed the GreenPlasma, MiniPlasma, and YellowKey security flaws three weeks ago as part of June 2026 Patch Tuesday updates.
organisation MiniPlasma
Microsoft fixed the GreenPlasma, MiniPlasma, and YellowKey security flaws three weeks ago as part of the June 2026 Patch Tuesday updates.
‎2026/07/01
BlueHammer flaw is now exploited in ransomware attacks.
infrastructure Windows
BlueHammer ya se utiliza en ciberataques de ransomware contra sistemas Windows.
Aunque el parche está disponible desde hace meses, la confirmación de su uso por parte de operadores de ransomware aumenta la urgencia de actualizar los dispositivos Windows que todavía sigan expuestos.
Windows BlueHammer flaw now exploited by ransomware gangs.
In Mid April, Huntress researchers reported attackers were exploiting the three Windows flaws to target systems, though the victims and attackers remain unknown.
Un usuario con permisos limitados podría acceder a recursos reservados y terminar ejecutando procesos con privilegios SYSTEM, el nivel más alto disponible en Windows.
El analista de vulnerabilidades Will Dormann explicó que el fallo permite acceder a la base de datos Security Account Manager, conocida como SAM, donde Windows almacena los hashes de las contraseñas de las cuentas locales.
" Over the past several months, Nightmare Eclipse has disclosed multiple other Windows zero-day exploits, including for the RoguePlanet , RedSun , GreenPlasma ,
Some of these vulnerabilities affect Microsoft Defender, while others target BitLocker and Windows components.
organisation BlueHammer
BlueHammer ya se utiliza en ciberataques de ransomware contra sistemas Windows.
BlueHammer allows attackers to escalate privileges locally in Microsoft Defender.
organisation ciberataques de ransomware contra sistemas
BlueHammer ya se utiliza en ciberataques de ransomware contra sistemas Windows.
organisation Microsoft Defender
Los grupos de ransomware han comenzado a explotar activamente BlueHammer para ciberataques, una vulnerabilidad de escalada de privilegios en Microsoft Defender que permite a un atacante con acceso local elevar sus permisos hasta alcanzar el nivel SYSTEM y tomar el control
BlueHammer allows attackers to escalate privileges locally in Microsoft Defender.
"Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally," Microsoft explains in a security advisory.
organisation una vulnerabilidad de escalada de privilegios
Los grupos de ransomware han comenzado a explotar activamente BlueHammer para ciberataques, una vulnerabilidad de escalada de privilegios en Microsoft Defender que permite a un atacante con acceso local elevar sus permisos hasta alcanzar el nivel SYSTEM y tomar el control
organisation un
Los grupos de ransomware han comenzado a explotar activamente BlueHammer para ciberataques, una vulnerabilidad de escalada de privilegios en Microsoft Defender que permite a un atacante con acceso local elevar sus permisos hasta alcanzar el nivel SYSTEM y tomar el control
organisation el control
Los grupos de ransomware han comenzado a explotar activamente BlueHammer para ciberataques, una vulnerabilidad de escalada de privilegios en Microsoft Defender que permite a un atacante con acceso local elevar sus permisos hasta alcanzar el nivel SYSTEM y tomar el control
organisation Aunque el
Aunque el parche está disponible desde hace meses, la confirmación de su uso por parte de operadores de ransomware aumenta la urgencia de actualizar los dispositivos Windows que todavía sigan expuestos.
organisation de operadores de ransomware
Aunque el parche está disponible desde hace meses, la confirmación de su uso por parte de operadores de ransomware aumenta la urgencia de actualizar los dispositivos Windows que todavía sigan expuestos.
organisation urgencia de actualizar los
Aunque el parche está disponible desde hace meses, la confirmación de su uso por parte de operadores de ransomware aumenta la urgencia de actualizar los dispositivos Windows que todavía sigan expuestos.
organisation Las vulnerabilidades de escalada de privilegios
De vulnerabilidad local a herramienta para el ransomware Las vulnerabilidades de escalada de privilegios son especialmente útiles en las operaciones de ransomware.
organisation las operaciones de ransomware
De vulnerabilidad local a herramienta para el ransomware Las vulnerabilidades de escalada de privilegios son especialmente útiles en las operaciones de ransomware.
organisation la primera cuenta comprometida
En muchos casos, la primera cuenta comprometida no dispone de permisos suficientes para desactivar herramientas de seguridad, acceder a datos sensibles o desplegar el ransomware en toda la red.
organisation Microsoft
Microsoft corrigió CVE-2026-33825 el 14 de abril.
"Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally," Microsoft explains in a security advisory.
The vulnerability, along with two other zero-days dubbed RedSun , and UnDefend , was disclosed by a researcher known as Chaotic Eclipse after criticizing Microsoft’s handling of the disclosure.
organisation the Microsoft Security Response Center
Dubbed BlueHammer, the security flaw ( CVE-2026-33825 ) was leaked by a security researcher known as "Nightmare Eclipse" in early April, together with proof-of-concept exploit code, in protest at how the Microsoft Security Response Center (MSRC) handles the disclosure process.
organisation MSRC
Dubbed BlueHammer, the security flaw ( CVE-2026-33825 ) was leaked by a security researcher known as "Nightmare Eclipse" in early April, together with proof-of-concept exploit code, in protest at how the Microsoft Security Response Center (MSRC) handles the disclosure process.
organisation Huntress
In Mid April, Huntress researchers reported attackers were exploiting the three Windows flaws to target systems, though the victims and attackers remain unknown.
organisation SYSTEM
Un usuario con permisos limitados podría acceder a recursos reservados y terminar ejecutando procesos con privilegios SYSTEM, el nivel más alto disponible en Windows.
organisation el nivel más alto
Un usuario con permisos limitados podría acceder a recursos reservados y terminar ejecutando procesos con privilegios SYSTEM, el nivel más alto disponible en Windows.
organisation El analista de vulnerabilidades
El analista de vulnerabilidades Will Dormann explicó que el fallo permite acceder a la base de datos Security Account Manager, conocida como SAM, donde Windows almacena los hashes de las contraseñas de las cuentas locales.
organisation el fallo permite
El analista de vulnerabilidades Will Dormann explicó que el fallo permite acceder a la base de datos Security Account Manager, conocida como SAM, donde Windows almacena los hashes de las contraseñas de las cuentas locales.
organisation SAM
El analista de vulnerabilidades Will Dormann explicó que el fallo permite acceder a la base de datos Security Account Manager, conocida como SAM, donde Windows almacena los hashes de las contraseñas de las cuentas locales.
Will Dormann, principal vulnerability analyst at Tharros, told BleepingComputer in April that while the issue is not easy to exploit, it gives local attackers access to the Security Account Manager (SAM) database, which contains password hashes for local accounts.
organisation Nightmare
" Over the past several months, Nightmare Eclipse has disclosed multiple other Windows zero-day exploits, including for the RoguePlanet , RedSun , GreenPlasma ,
organisation GreenPlasma
" Over the past several months, Nightmare Eclipse has disclosed multiple other Windows zero-day exploits, including for the RoguePlanet , RedSun , GreenPlasma ,
organisation BitLocker
Some of these vulnerabilities affect Microsoft Defender, while others target BitLocker and Windows components.
organisation Tharros
Will Dormann, principal vulnerability analyst at Tharros, told BleepingComputer in April that while the issue is not easy to exploit, it gives local attackers access to the Security Account Manager (SAM) database, which contains password hashes for local accounts.
organisation BleepingComputer
Will Dormann, principal vulnerability analyst at Tharros, told BleepingComputer in April that while the issue is not easy to exploit, it gives local attackers access to the Security Account Manager (SAM) database, which contains password hashes for local accounts.
organisation fue corregida
La vulnerabilidad había sido explotada previamente como día cero y fue corregida por Microsoft el pasado 14 de abril dentro de sus actualizaciones de seguridad mensuales.
organisation Microsoft el
La vulnerabilidad había sido explotada previamente como día cero y fue corregida por Microsoft el pasado 14 de abril dentro de sus actualizaciones de seguridad mensuales.
organisation la gestión de permisos permite
Según la descripción de Microsoft, una granularidad insuficiente en la gestión de permisos permite que un atacante autorizado localmente eleve sus privilegios dentro del sistema.
organisation Esto
Esto significa que el fallo no permite comprometer un equipo directamente desde internet.
organisation Sin
Sin embargo, una vez dentro, la vulnerabilidad puede ser decisiva para avanzar en el ataque.
organisation una vez dentro
Sin embargo, una vez dentro, la vulnerabilidad puede ser decisiva para avanzar en el ataque.
organisation El
El acceso a esta información puede facilitar el robo de credenciales, el movimiento lateral hacia otros sistemas y la consolidación del control sobre el dispositivo.
organisation el robo de credenciales
El acceso a esta información puede facilitar el robo de credenciales, el movimiento lateral hacia otros sistemas y la consolidación del control sobre el dispositivo.
organisation el movimiento
El acceso a esta información puede facilitar el robo de credenciales, el movimiento lateral hacia otros sistemas y la consolidación del control sobre el dispositivo.
organisation los atacantes podrían
Tras elevar sus privilegios, los atacantes podrían manipular defensas, extraer credenciales, crear nuevas cuentas administrativas, desactivar servicios y ejecutar el cifrado con mayores garantías de éxito.
organisation extraer
Tras elevar sus privilegios, los atacantes podrían manipular defensas, extraer credenciales, crear nuevas cuentas administrativas, desactivar servicios y ejecutar el cifrado con mayores garantías de éxito.
organisation el cifrado
Tras elevar sus privilegios, los atacantes podrían manipular defensas, extraer credenciales, crear nuevas cuentas administrativas, desactivar servicios y ejecutar el cifrado con mayores garantías de éxito.
organisation la cadena de ataque
Este tipo de vulnerabilidad no suele constituir por sí sola toda la cadena de ataque, pero puede convertirse en una pieza fundamental para transformar una intrusión limitada en un compromiso completo.
organisation El exploit
El exploit se filtró antes del parche BlueHammer fue divulgada a comienzos de abril por un investigador conocido como “Nightmare Eclipse”, quien publicó además un código de prueba de concepto.
organisation un código de prueba de concepto
El exploit se filtró antes del parche BlueHammer fue divulgada a comienzos de abril por un investigador conocido como “Nightmare Eclipse”, quien publicó además un código de prueba de concepto.
organisation los procesos de comunicación de vulnerabilidades
Centro de Respuesta de Seguridad de Microsoft gestionaba los procesos de comunicación de vulnerabilidades.
organisation una corrección aumentó
La publicación del exploit antes de que la mayoría de los usuarios pudiera aplicar una corrección aumentó considerablemente el riesgo.
organisation el riesgo
La publicación del exploit antes de que la mayoría de los usuarios pudiera aplicar una corrección aumentó considerablemente el riesgo.
organisation parte de los operadores
Los ataques observados mostraban actividad manual directa por parte de los operadores, lo que sugiere que la vulnerabilidad estaba siendo utilizada dentro de intrusiones dirigidas y no únicamente mediante herramientas automatizadas.
organisation siendo
Los ataques observados mostraban actividad manual directa por parte de los operadores, lo que sugiere que la vulnerabilidad estaba siendo utilizada dentro de intrusiones dirigidas y no únicamente mediante herramientas automatizadas.
organisation dentro de intrusiones dirigidas
Los ataques observados mostraban actividad manual directa por parte de los operadores, lo que sugiere que la vulnerabilidad estaba siendo utilizada dentro de intrusiones dirigidas y no únicamente mediante herramientas automatizadas.
organisation El código de prueba podía
El código de prueba podía servir a otros investigadores para estudiar el fallo, pero también proporcionaba a los atacantes una base para desarrollar herramientas operativas.
organisation el fallo
El código de prueba podía servir a otros investigadores para estudiar el fallo, pero también proporcionaba a los atacantes una base para desarrollar herramientas operativas.
organisation apuntaban
Sin embargo, pocos días después, investigadores de Huntress Labs informaron de señales que apuntaban a su explotación como vulnerabilidad de día cero antes de la llegada del parche.
organisation Dormann
“At that point, [the attackers] basically own the system, and can do things like spawn a SYSTEM-privileged shell,” Dormann said.
organisation Huntress Labs
However, days later, Huntress Labs security researchers revealed that threat actors had been exploiting it as a zero-day in attacks that showed evidence of "hands-on-keyboard threat actor activity.
organisation YellowKey
MiniPlasma , YellowKey , and UnDefend flaws.
organisation EDR
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Tactical Metrics
Metrics
infrastructure
‎Windows
Affected Product
In Mid April, Huntress researchers reported attackers were exploiting the three Windows flaws to target systems, though the victims and attackers remain unknown.
BlueHammer ya se utiliza en ciberataques de ransomware contra sistemas Windows.
Aunque el parche está disponible desde hace meses, la confirmación de su uso por parte de operadores de ransomware aumenta la urgencia de actualizar los dispositivos Windows que todavía sigan expuestos.
Un usuario con permisos limitados podría acceder a recursos reservados y terminar ejecutando procesos con privilegios SYSTEM, el nivel más alto disponible en Windows.
El analista de vulnerabilidades Will Dormann explicó que el fallo permite acceder a la base de datos Security Account Manager, conocida como SAM, donde Windows almacena los hashes de las contraseñas de las cuentas locales.
Windows BlueHammer flaw now exploited by ransomware gangs.
Flagged as exploited by ransomware gangs CISA added the BlueHammer flaw to its Known Exploited Vulnerabilities (KEV) Catalog  on April 22, ordering Federal Civilian Executive Branch (FCEB) agencies to patch their Windows devices against ongoing CVE-2026-33825 attacks within two weeks, until May 7.
" Over the past several months, Nightmare Eclipse has disclosed multiple other Windows zero-day exploits, including for the RoguePlanet , RedSun , GreenPlasma ,
Some of these vulnerabilities affect Microsoft Defender, while others target BitLocker and Windows components.
Intelligence Sources
BleepingComputer 2026-06-30
Bit Life Media 2026-07-01
Security Affairs 2026-07-01