Cybersecurity — 2026-04-17
Disgruntled researcher publishes second Defender zero-day chain after Microsoft disclosure dispute
A researcher operating as
Analysis
Chaotic Eclipse's UnDefend release converts what appeared to be a single bounty grievance into a sustained adversarial campaign against MSRC governance; the personal naming of an MSRC VP creates a targeting dimension that extends consequences beyond the technical. With BlueHammer now patched and RedSun still open, Redmond is defending its disclosure process rather than its patch cadence, a harder position. The consistent productization timeline across the two prior drops supports a moderate-confidence judgment that UnDefend will likely reach commodity ransomware tooling within 14 days. The observable that arrests this trajectory is MSRC formally engaging the researcher or escrowing the bounty dispute through a neutral third party; absent that signal, a third drop within 30 days is the working assumption.
Chaotic Eclipse's UnDefend release converts what appeared to be a single bounty grievance into a sustained adversarial campaign against MSRC governance; the personal naming of an MSRC VP creates a targeting dimension that extends consequences beyond the technical. With BlueHammer now patched and RedSun still open, Redmond is defending its disclosure process rather than its patch cadence, a harder position. The consistent productization timeline across the two prior drops supports a moderate-confidence judgment that UnDefend will likely reach commodity ransomware tooling within 14 days. The observable that arrests this trajectory is MSRC formally engaging the researcher or escrowing the bounty dispute through a neutral third party; absent that signal, a third drop within 30 days is the working assumption.
4 sources
- Recently leaked Windows zero-days now exploited in attacks -
BleepingComputer - Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched -
The Hacker News - Disgruntled researcher releases second major Windows zero-day -
TechRadar - BlueHammer Windows Zero-Day Exploit Signals Microsoft Bug Disclosure Issues -
Dark Reading