Title: Some updates about my current plans and more about the recent defender exploits, (RoguePlanet, RedSun, BlueHammer)
Date: 2026-06-15
Source: pnc
Origin: https://blog.projectnightcrawler.dev/posts/2026-06-15-some-updates-about-my-current-plans-and-more-about-the-recent-defender-exploits-rogueplanet-redsun-bluehammer/
Author: NightmareEclipse
Mirror: live
Upstream live: yes

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

We moved from blogger after censorship unfortunately, after request a review from google they reinstated the deleted blogs but since we are here, we're continuing here and the google blog stays as a backup.

Now regarding the recent defender bugs, they were incredibly difficult to find and making a full exploit for them was brutal but I did it regardless.
I was aware of a special defender behaviour during the development of BlueHammer where using a special flag MPSCAN_OPTION_NOCONSOLIDATE will cause defender to not show a toast warning about it finding a threat it in the system (which was triggered by eicar)
After RedSun, I had my hands on some public ITW samples where they used this flag to hide the exploitation attempt from the user and since the RedSun had a guaranteed success rate, the pop-up just never shows up. While it still shows if you go check it in protection history or using EDR, but there was no immediate pop-up alerting the user that something was wrong.
During the development of RoguePlanet, I finally decided to include the flag, which can be found here - 
https://git.projectnightcrawler.dev/NightmareEclipse/RoguePlanet/src/branch/main/RoguePlanet.cpp#L78086
I'm not sure if many of you have noticed but if the exploit succeeds, no pup-up shows, only when the race fails. Same applied for BlueHammer and RedSun.

I have read many attempts to detect/block the PoC through signatures but none of them seem effective because small changes in the PoC can completely bypass your mitigations. The only thing you can realistically do is wait for a patch from Microsoft.

Now considering some recent life events, I got incredibly depressed and I was unable to get back up again and start writing code and I started questioning this whole thing in general. Usually Microsoft just does something that pisses me off so much I end up dropping bugs but recently they have been silent which contributed a bit to my pause. Unlike what they did for the past years, they seemingly chose to let the fire calm on it's own. I doubt it will work since eventually they will be forced to speak and they will definitely boil the blood in my veins and the whole cycle starts again. 
For now I'm taking a break.

Hope we meet again, friends.
-----BEGIN PGP SIGNATURE-----

iHUEARYKAB0WIQRJTvAf/AWVhAKEeb7FFoRCS0/SbAUCajB3YgAKCRDFFoRCS0/S
bDkGAQC3/q5GX9qXpR2yt5hMnb//fVdqiXC1rxmewhioLkhgawEA9bRoHnjKlRfn
wTVGHV9CZlEFyWtKGgP9wdkJyyJEYQs=
=Wj15
-----END PGP SIGNATURE-----
