Hackers are abusing unpatched Windows security flaws to hack into organizations

In a concerning development, hackers have reportedly infiltrated at least one organization by leveraging security vulnerabilities in Windows that were made public by a disgruntled security researcher. According to Huntress, a cybersecurity firm, these attacks have occurred over the past two weeks, with three specific flaws identified: BlueHammer, UnDefend, and RedSun. So far, only BlueHammer has received a patch from Microsoft, which was released earlier this week. The exploitation of these vulnerabilities is believed to stem from exploit codes shared online by the researcher known as Chaotic Eclipse. This individual hinted at a conflict with Microsoft as the motivation for their actions, stating, "I was not bluffing Microsoft and I’m doing it again. Huge thanks to MSRC leadership for making this possible." Chaotic Eclipse went on to publish exploit codes for all three vulnerabilities on their GitHub page. These flaws particularly affect Windows Defender, Microsoft’s antivirus software, potentially allowing attackers to gain high-level access to compromised machines. Attempts to reach Chaotic Eclipse for a comment were unsuccessful. In response to inquiries, Microsoft’s communications director, Ben Hope, emphasized the company's commitment to "coordinated vulnerability disclosure." This practice aims to ensure that vulnerabilities are thoroughly investigated and addressed before they are made public, thereby protecting customers and supporting the security research community. This situation is a classic example of what the cybersecurity sector refers to as "full disclosure." Typically, when researchers discover vulnerabilities, they report them to software companies to facilitate repairs. However, communication can sometimes break down, leading to premature public disclosures. In such instances, researchers may publish "proof-of-concept" codes, demonstrating how to exploit the vulnerabilities. This, in turn, provides cybercriminals with the tools to carry out their attacks. John Hammond, a researcher at Huntress, remarked on the implications of these disclosures, stating, "With these being so easily available now, and already weaponized for easy use, it puts us in another tug-of-war match between defenders and cybercriminals. Defenders must race to protect against malicious actors who are quick to exploit these vulnerabilities, especially as they become ready-made tools for attackers."