Loading malware…
RedSun is a publicly released Windows local privilege escalation exploit associated with the Nightmare-Eclipse or Chaotic Eclipse toolset. It abuses Microsoft Defender’s SYSTEM-privileged remediation and cloud file handling workflow to elevate a standard user to NT AUTHORITY\SYSTEM without requiring administrator rights, credential theft, kernel exploitation, or memory corruption. The exploit has been reported as affecting Windows 10, Windows 11, and Windows Server 2019 and later, and was later associated with CVE-2026-41091.
RedSun operates by chaining legitimate Windows components and features into a race-condition-based exploit path. Reported implementations use Cloud Files API placeholders, opportunistic locks, NTFS junctions or reparse-point redirection, and Volume Shadow Copy related timing signals to convert Defender’s privileged restore or remediation action into an attacker-controlled write into the Windows system directory. Public analyses describe the exploit overwriting TieringEngineService.exe with attacker-controlled code and then invoking the Storage Tiers Management COM service so the replaced binary executes as SYSTEM. Some descriptions also note use of a named pipe and token/session manipulation to spawn an interactive SYSTEM process in the attacker’s active session.
RedSun is part of a broader cluster of Defender-focused offensive tooling that also includes BlueHammer and UnDefend. Multiple reports state that these tools were observed in real-world intrusions shortly after public release, including incidents where attackers first obtained access through compromised FortiGate VPN credentials and then attempted privilege escalation and post-compromise activity on Windows hosts. RedSun is therefore best understood as a post-compromise privilege escalation capability rather than an initial access mechanism. Detection guidance commonly focuses on behavioral artifacts such as anomalous Cloud Files API usage by unexpected processes, suspicious junction creation in temporary directories, and TieringEngineService.exe spawning shell or scripting processes under SYSTEM context.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
For background on the earlier tools in this series, see our analysis of BlueHammer (CVE-2026-33825) and RedSun (CVE-2026-41091).
In the RedSun exploit this is a side-effect of the DoCloudStuff() function that registers a fake sync provider to create the cloud-tagged bait file.
26 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Cyderes Howler Cell has tracked it since its first release, with prior coverage of BlueHammer, RedSun, RoguePlanet, GreatXML, and most recently LegacyHive in July 2026.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Description Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session. RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
The exploit loops NtCreateFile calls with GENERIC_WRITE and FILE_SUPERSEDE against TieringEngineService.exe until one succeeds during the race window.
That fix didn't stop attackers from exploiting BlueHammer, as well as targeting RedSun and UnDefend after Nightmare-Eclipse's disclosure of those exploits.
With the file in place, the exploit activates the Storage Tiers Management COM object using CoCreateInstance and CLSID {50d185b9-fff3-4656-92c7-e4018da4361d}. | If confirmed, it connects to the named pipe \\.\pipe\REDSUN created during Phase 1.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
RedSun (CVE-2026-41091) is a local privilege escalation vulnerability in Windows Defender’s file remediation workflow... A standard, unprivileged user can exploit this behavior to achieve arbitrary file writes to C:\Windows\System32 and ultimately execute code as NT AUTHORITY\SYSTEM.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
First, it POSIX-deletes the original EICAR file... Unlike standard Windows delete semantics... POSIX delete frees the name slot right away. This is critical because the placeholder must be created at the same filename.
Threat actors were observed deploying the tools under disguised filenames such as FunnyApp.exe, gaining initial access through compromised FortiGate VPN credentials before pivoting to Defender exploits for privilege escalation.
DuplicateTokenEx (htoken, TOKEN_ALL_ACCESS , NULL , SecurityDelegation , TokenPrimary , & hnewtoken); SetTokenInformation (hnewtoken, TokenSessionId , & sessionid, sizeof( DWORD )); CreateProcessAsUser (hnewtoken, L "C: \ Windows \ System32 \ conhost.exe" , ... );
The “Fake” service then steals the session ID from a local Named Pipe to launch a visible shell.
LaunchTierManagementEng activates the Storage Tiers Management COM object with CLSCTX_LOCAL_SERVER, which causes Windows to launch TieringEngineService.exe as SYSTEM because that is how the service is registered.
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
RedSun: Abuses Defender’s cloud file rollback mechanism to execute attacker-planted binaries as SYSTEM; remains unpatched as of May 2026.
An attacker redirects that write via an NTFS junction into C:\Windows\System32, dropping an attacker-controlled binary and executing it as SYSTEM
Achieve SYSTEM Execution -- Copy the exploit binary to the resulting System32\TieringEngineService.exe, activate the Storage Tiers Management COM object (which launches the binary as SYSTEM), and deliver a SYSTEM-level console to the user’s desktop.
...in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands...
The Volume Shadow Copy Service creates point-in-time snapshots of volumes... These device objects are enumerable by standard users via NtQueryDirectoryObject on the \Device directory. When Defender creates a VSS snapshot... the exploit can detect that Defender has begun its remediation sequence.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A prior named tool in the same NightmareEclipse exploit cluster, mentioned as historical context and related coverage.
Named item tied to CVE-2026-41091 in the Chaotic Eclipse disclosures; Sophos lists detection as ATK/RedSun-A.
A related tool in the Nightmare-Eclipse cluster; the content provides limited technical detail beyond the CVE reference.
An earlier exploit in the same Nightmare-Eclipse cluster targeting Microsoft Defender or adjacent Windows security components; the content says it was seen in live intrusion chains and patched out-of-band.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.