Hackers Are Abusing Unpatched Windows Flaws to Break Into Organizations

A security researcher's public dispute with Microsoft has turned into a real-world headache for organizations still scrambling to protect their Windows systems. Over the past two weeks, hackers have been actively exploiting three Windows vulnerabilities dubbed BlueHammer, UnDefend, and RedSun using exploit code published online by a disgruntled researcher who goes by the alias Chaotic Eclipse .

Cybersecurity firm Huntress confirmed on Friday that it has observed at least one organization being successfully breached using these flaws . It remains unclear who the target was or who the hackers are, but the incident underscores the dangers of "full disclosure" when communication between researchers and software makers breaks down.

The Vulnerabilities

All three flaws affect Microsoft's Windows Defender , the company's built-in antivirus software. Exploiting them allows a hacker to gain high-level or administrator access to an affected Windows computer essentially giving them full control over the machine .

Of the three, BlueHammer is the only one Microsoft has patched so far , with a fix rolled out earlier this week . The other two, UnDefend and RedSun, remain unpatched as of this writing, leaving organizations exposed.

The exploit code for all three vulnerabilities was published on Chaotic Eclipse's GitHub page, making it readily available to anyone including cybercriminals and state-sponsored hackers who wants to use it .

The Researcher's Motivation

Chaotic Eclipse did not publish the code quietly. The researcher alluded to a conflict with Microsoft as the driving motivation.

"I was not bluffing Microsoft and I'm doing it again," they wrote on their blog. "Huge thanks to MSRC leadership for making this possible," they added, referring to the Microsoft Security Response Center (MSRC) , the company's team that handles vulnerability reports .

Days later, they published UnDefend, followed by RedSun earlier this week. Each publication was accompanied by working exploit code, turning theoretical vulnerabilities into practical weapons .

The Full Disclosure Debate

This is a textbook case of what the cybersecurity industry calls "full disclosure." The typical process works like this: a researcher finds a flaw, reports it to the affected software maker, and the two parties agree on a timeline for patching and public disclosure. The researcher agrees to keep details private until the patch is ready, protecting users from attackers who might otherwise exploit the flaw.

But when communication breaks down for any number of reasons researchers sometimes take matters into their own hands. They may publish details to pressure the company into action, or to prove that the vulnerability is real and severe. Some go a step further and publish proof-of-concept (PoC) code , which demonstrates exactly how the bug can be exploited.

Once that code is public, the race begins. Attackers can weaponize it within hours or days, while defenders scramble to protect their systems before the patches arrive .

The Fallout

John Hammond, one of the Huntress researchers tracking the case, described the situation as a "tug-of-war" between defenders and cybercriminals.

"With these being so easily available now, and already weaponized for easy use, for better or for worse I think that ultimately puts us in another tug-of-war match between defenders and cybercriminals," he told TechCrunch .

He added: "Scenarios like these cause us to race with our adversaries; defenders frantically try to protect against ill-intended actors who rapidly take advantage of these exploits… especially now as it is just ready-made attacker tooling" .

In other words, the publication of exploit code does not just pressure Microsoft to patch faster. It also hands a ready-made weapon to anyone with malicious intent, forcing defenders into a reactive, high-stakes race they may not win .

Microsoft's Response

Microsoft's communications director, Ben Hope, issued a statement in response to questions from TechCrunch. The company said it supports "coordinated vulnerability disclosure," the industry-standard practice that balances researcher transparency with customer protection .

The statement did not address the specifics of the Chaotic Eclipse case, nor did it explain why the three vulnerabilities were not patched before the researcher went public. Microsoft has not announced a timeline for patching UnDefend or RedSun .

What Organizations Should Do?

For organizations still running Windows systems, the situation is urgent:

Apply the BlueHammer patch immediately if you have not already done so.

Monitor for indicators of compromise associated with these exploits. Huntress and other security firms may release detection guidance in the coming days.

Assume that proof-of-concept code is already in attackers' hands . Do not wait for widespread reporting of breaches before taking action.

Consider additional layers of defense , such as endpoint detection and response (EDR) tools, that can detect and block exploitation attempts even before patches are applied .

The Chaotic Eclipse incident is a reminder that vulnerability disclosure is not an abstract debate between researchers and vendors. It has real-world consequences. When a researcher publishes exploit code, attackers will use it. When a vendor fails to patch in a timely manner, defenders are left exposed.

In this case, both sides appear to share responsibility. The researcher's frustration may be understandable, but publishing working exploit code puts users at risk. Microsoft's failure to patch all three vulnerabilities before the researcher went public left those same users vulnerable.

The only certainty is that organizations caught in the middle need to act now. The patches for two of the three flaws are not yet available. The exploits are. That is a dangerous combination, and it is one that will likely lead to more breaches before the situation is resolved .