Loading malware…
RedSun is a publicly released Windows local privilege-escalation exploit developed by the researcher known as Nightmare-Eclipse or Chaotic Eclipse. Associated with CVE-2026-41091, it enables a standard user to obtain SYSTEM privileges on Windows 10, Windows 11, and Windows Server 2019 and later by abusing Microsoft Defender’s privileged handling of cloud-tagged files during remediation.
The exploit combines Cloud Files API placeholders, opportunistic locks, NTFS junctions, and Volume Shadow Copy behavior to exploit a time-of-check to time-of-use race condition. It redirects a Defender restoration operation into a protected system directory, replacing the Storage Tiers Management service binary with attacker-controlled code. Activating the corresponding COM object executes the replacement as SYSTEM, allowing an elevated shell to appear in the attacker’s interactive session. The chain does not require administrator rights, credential theft, memory corruption, or a kernel exploit.
RedSun was released in April 2026 alongside the related BlueHammer and UnDefend tools. It has been observed in a live enterprise intrusion following compromised FortiGate SSL VPN access, although its privilege-escalation attempt did not succeed in that investigated incident. It is a post-compromise escalation tool rather than an initial-access mechanism.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
26 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Nightmare-Eclipse/RedSun — evasion framework” | EDRStartupHinder, RedSun evasion framework.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
+20 more in the app. View in Mallory
28 distinct techniques documented for this family, organized by ATT&CK tactic.
Le chercheur anonyme opérant sous le pseudonyme Nightmare Eclipse a publié un exploit d’élévation de privilèges... Le PoC est disponible publiquement sur GitHub.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
Huntress observed in-the-wild use of Nightmare-Eclipse tooling, including BlueHammer, RedSun, and UnDefend, in a live intrusion involving FortiGate VPN compromise as the initial access...
Upon execution in the SYSTEM context, the payload duplicates a privileged token, assigns it to the active user session, and spawns an interactive console (conhost.exe), granting the attacker full administrative control.
The exploit loops NtCreateFile calls with GENERIC_WRITE and FILE_SUPERSEDE against TieringEngineService.exe until one succeeds during the race window.
That fix didn't stop attackers from exploiting BlueHammer, as well as targeting RedSun and UnDefend after Nightmare-Eclipse's disclosure of those exploits.
With the file in place, the exploit activates the Storage Tiers Management COM object using CoCreateInstance and CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}. | If confirmed, it connects to the named pipe \\.\pipe\REDSUN created during Phase 1.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
RedSun (CVE-2026-41091) is a local privilege escalation vulnerability in Windows Defender’s file remediation workflow... A standard, unprivileged user can exploit this behavior to achieve arbitrary file writes to C:\Windows\System32 and ultimately execute code as NT AUTHORITY\SYSTEM.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
The core insight is that Defender is a SYSTEM-privileged process that performs file operations on paths a standard user controls.
dropping an attacker-controlled binary and executing it as SYSTEM through a COM service invocation
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
the engine's remediation logic attempts to "restore" or overwrite the file to neutralize the threat.
First, it POSIX-deletes the original EICAR file... Unlike standard Windows delete semantics... POSIX delete frees the name slot right away. This is critical because the placeholder must be created at the same filename.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
By manipulating what those paths resolve to using NTFS junction points... the exploit turns Defender’s own remediation workflow into a write primitive that crosses the privilege boundary into a protected system directory.
HW breakpoint removal from DR registers, NTDLL unhooking, ETW patching.
With SYSTEM access and Microsoft Defender degraded, the attacker proceeds to credential harvesting (SAM, LSASS, cached domain credentials)
...in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands...
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
...in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands, and likely tunneling activity.
a binary named FunnyApp.exe — a build pulled directly from the public BlueHammer GitHub repository was executed from a victim user’s Pictures folder ... RedSun.exe ... alongside multiple executions of undef.exe
An attacker races this window using a batch OPLOCK, swaps the target directory with a mount point reparse to C:\Windows\System32, and Defender completes the write.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
23 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.