Loading malware…
RedSun is a publicly released Windows local privilege escalation exploit associated with the Nightmare-Eclipse or Chaotic Eclipse researcher cluster. It abuses Microsoft Defender’s privileged remediation workflow to elevate a standard user to NT AUTHORITY\SYSTEM without requiring administrator rights, credential theft, kernel exploitation, or memory corruption. Public reporting and detections describe RedSun as active in the wild and used alongside related Defender-focused tooling such as BlueHammer and UnDefend.
RedSun targets Windows systems including Windows 10, Windows 11, and Windows Server 2019 and later. The exploit chains legitimate Windows components and features, including Microsoft Defender, Cloud Files functionality, opportunistic locking, NTFS junction or reparse-point redirection, and Volume Shadow Copy-related timing signals. The core weakness is a race condition and path-redirection flaw in Defender’s handling of cloud-tagged malicious files during remediation or restoration. By manipulating the timing of Defender’s privileged file operations and redirecting the destination through filesystem indirection, RedSun causes Defender to write an attacker-controlled binary into the Windows system directory.
A commonly described execution path overwrites TieringEngineService with attacker code and then invokes the Storage Tiers Management COM server so the replaced binary is launched as SYSTEM. Detection guidance also notes that successful exploitation often results in TieringEngineService spawning shell-related child processes in the attacker’s interactive session. Some technical analyses further describe use of Cloud Files placeholder creation and named-pipe coordination as part of the exploit chain.
RedSun is best characterized as a post-compromise privilege-escalation tool rather than an initial access mechanism. In observed intrusions, it has appeared after other access vectors, including compromised VPN access, and alongside reconnaissance and follow-on tooling. The exploit is part of a broader series of Windows Defender abuse techniques released in 2026, several of which were later assigned CVEs or patched out of band. RedSun has been associated with CVE-2026-41091 in later reporting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
25 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
The exploit loops NtCreateFile calls with GENERIC_WRITE and FILE_SUPERSEDE against TieringEngineService.exe until one succeeds during the race window.
That fix didn't stop attackers from exploiting BlueHammer, as well as targeting RedSun and UnDefend after Nightmare-Eclipse's disclosure of those exploits.
With the file in place, the exploit activates the Storage Tiers Management COM object using CoCreateInstance and CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}. | If confirmed, it connects to the named pipe \\.\pipe\REDSUN created during Phase 1.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
RedSun (CVE-2026-41091) is a local privilege escalation vulnerability in Windows Defender’s file remediation workflow... A standard, unprivileged user can exploit this behavior to achieve arbitrary file writes to C:\Windows\System32 and ultimately execute code as NT AUTHORITY\SYSTEM.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
First, it POSIX-deletes the original EICAR file... Unlike standard Windows delete semantics... POSIX delete frees the name slot right away. This is critical because the placeholder must be created at the same filename.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
...in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands...
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior Windows privilege escalation proof of concept that abused the Cloud Files API and TieringEngineService to redirect a Defender write into System32.
A prior named tool in the same NightmareEclipse exploit cluster, mentioned as historical context and related coverage.
Named item tied to CVE-2026-41091 in the Chaotic Eclipse disclosures; Sophos lists detection as ATK/RedSun-A.
A related tool in the Nightmare-Eclipse cluster; the content provides limited technical detail beyond the CVE reference.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.