04/23/2026
Microsoft shipped an antivirus with three zero-days in 13 days.
Patch Tuesday fixed one. Math isn’t mathing.
- BlueHammer → SYSTEM.
- RedSun → SYSTEM.
- UnDefend → tells your EDR everything’s fine while Defender quietly loses its mind.
Chain them and your endpoint escalates, goes dark, and gaslights your SOC on the way out.
Already in the wild. SSLVPN was the welcome mat.
https://www.aegisbyte.com/blog/defender-becomes-the-door-bluehammer-redsun-undefend