Cyber Threat Brief — Issue #007

Two Microsoft Defender zero-days, tracked as RedSun and UnDefend by the researcher who discovered them, are being actively exploited in the wild. RedSun allows an authenticated local attacker to escalate to SYSTEM-level privileges by exploiting how Defender's Malware Protection Engine resolves file links before accessing them. UnDefend allows any standard user to block Defender from receiving definition updates, effectively blinding the endpoint protection layer and creating a window for follow-on attacks. Both were added to the CISA KEV catalog on May 20, 2026, with a federal remediation deadline of June 3. The combination is particularly dangerous as a chained attack. UnDefend disables Defender's ability to update its threat definitions. RedSun then elevates the attacker to SYSTEM. The security tool defending the endpoint becomes the attack path into it. Microsoft Defender updates are automatic by default but organizations should manually verify the patch landed, especially on managed devices, offline systems, and privileged workstations.

Operation Olalampo, MuddyWater's 2026 espionage campaign first observed on January 26, has continued to expand in scope and geographic reach through May. New reporting from Symantec and Carbon Black confirms the campaign has hit at least nine organizations across nine countries on four continents in Q1 2026 alone, including a major South Korean electronics manufacturer, an international airport in the Middle East, and a Latin American financial services provider. The campaign deploys four novel malware families — GhostFetch, HTTP_VIP, CHAR, and GhostBackDoor — delivered via spear-phishing emails with malicious Office document attachments tailored to regional themes. The CHAR backdoor is Rust-based, and Group-IB researchers identified evidence of AI-assisted development in the malware construction, consistent with the broader 2026 trend of nation-state actors integrating AI into their development pipelines. MuddyWater's mandate is strategic intelligence collection, not financial theft. The group is patient, maintains long-dwell access, and extracts sensitive communications and intellectual property over extended periods before detection.

CISA's May 20, 2026 KEV catalog update included four Microsoft vulnerabilities from 2008, 2009, and 2010 alongside the two Defender zero-days. CVE-2008-4250, CVE-2009-1537, CVE-2010-0249, and CVE-2010-0806 affect Windows components including Internet Explorer and DirectX. The return of decade-old exploits to active exploitation status is not an anomaly. Threat intelligence firms report that APT groups and ransomware actors are deliberately blending legacy exploits with modern payloads to evade endpoint detection tools trained on contemporary attack patterns. A 2008 Windows buffer overflow paired with a 2026 Defender bypass payload is a combination that legacy-aware EDR tools may not catch. The inclusion of CVE-2010-2568, a Windows LNK file vulnerability historically associated with Stuxnet and air-gap jumping techniques, suggests a possible resurgence of interest in targeting isolated or air-gapped environments.