Loading malware…
RedSun is a publicly released Windows local privilege escalation exploit/tool that abuses Microsoft Defender privileged remediation behavior to elevate a standard user to NT AUTHORITY\SYSTEM. Public reporting and detections describe it as part of the Nightmare-Eclipse / Chaotic Eclipse toolset released alongside BlueHammer and UnDefend, and it has been associated with in-the-wild intrusion activity observed by Huntress.
Across the provided sources, RedSun is described as targeting Windows 10, Windows 11, and Windows Server 2019 and later. It abuses a logic flaw or TOCTOU-style race condition in Defender’s handling of cloud-tagged malicious files and related Windows Cloud Files / NTFS interactions. Reported techniques include use of opportunistic locks, NTFS junctions/reparse points, Cloud Files API placeholders, and Volume Shadow Copy-related timing to redirect a privileged Defender write into C:\Windows\System32. Multiple sources state the exploit overwrites TieringEngineService.exe with an attacker-controlled binary and then triggers execution via the Storage Tiers Management COM object, resulting in a SYSTEM-level process in the attacker’s session. Reported spawned processes include conhost.exe, cmd.exe, and PowerShell. One source specifically notes use of CLSID {50d185b9-fff3-4656-92c7-e4018da4361d} and a named pipe \.\pipe\REDSUN.
The content consistently characterizes RedSun as not requiring administrator rights, credential theft, memory corruption, a kernel vulnerability, or a code injection primitive. It is described as being publicly released on GitHub by Nightmare-Eclipse / Chaotic Eclipse in April 2026. Huntress reported real-world use of Nightmare-Eclipse tooling including RedSun in an intrusion that began with compromised FortiGate VPN access, though Huntress also stated observed RedSun execution did not appear to succeed in that specific case.
Detection opportunities directly mentioned in the content include suspicious child processes spawned by TieringEngineService.exe, unusual cldapi.dll loads, rapid creation of Temp directories that become junctions to System32, creation of Cloud Files logs such as C:\Windows\System32\LogFiles\CloudFiles\CldFlt0.etl by non-system processes, and named pipe activity involving \pipe\REDSUN. The content also references RedSun as CVE-2026-41091 in some reporting.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
26 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The exploit loops NtCreateFile calls with GENERIC_WRITE and FILE_SUPERSEDE against TieringEngineService.exe until one succeeds during the race window.
That fix didn't stop attackers from exploiting BlueHammer, as well as targeting RedSun and UnDefend after Nightmare-Eclipse's disclosure of those exploits.
With the file in place, the exploit activates the Storage Tiers Management COM object using CoCreateInstance and CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}. | If confirmed, it connects to the named pipe \\.\pipe\REDSUN created during Phase 1.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
RedSun (CVE-2026-41091) is a local privilege escalation vulnerability in Windows Defender’s file remediation workflow... A standard, unprivileged user can exploit this behavior to achieve arbitrary file writes to C:\Windows\System32 and ultimately execute code as NT AUTHORITY\SYSTEM.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
First, it POSIX-deletes the original EICAR file... Unlike standard Windows delete semantics... POSIX delete frees the name slot right away. This is critical because the placeholder must be created at the same filename.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
...in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands...
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named item tied to CVE-2026-41091 in the Chaotic Eclipse disclosures; Sophos lists detection as ATK/RedSun-A.
A related tool in the Nightmare-Eclipse cluster; the content provides limited technical detail beyond the CVE reference.
An earlier exploit in the same Nightmare-Eclipse cluster targeting Microsoft Defender or adjacent Windows security components; the content says it was seen in live intrusion chains and patched out-of-band.
A Windows Defender exploit tool that abuses the cloud file rollback mechanism to execute attacker-planted binaries with SYSTEM privileges.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.