Open Veils · Answer
Operation Red Sun
RedSun is a zero-day logic vulnerability in Microsoft Defender — not a remote code execution bug, but a privilege escalation chain that turns Defender's own remediation engine into a SYSTEM-level file writer. A standard unprivileged user can achieve full system compromise without touching the kernel, UAC, or admin credentials. It was already being exploited in the wild before Microsoft issued any patch or CVE.
Evidence
- Per nefariousplan.com's April 19 writeup, the placed binary targets TieringEngineService.exe, a Storage Tiers Management COM server, which is then executed to complete the privilege escalation.
- Calif.io's June 2026 research confirms the file rewrite reaches C:\Windows with no administrative rights required.
- At time of reporting, no CVE had been assigned and no patch had been issued.