Indicators are what attackers leave behind. Stolen credentials are what they arrive with.

1 IOC

THREAT ADVISORY RedSun Zero-Day (Windows Defender) April 17, 2026

Blackswan Cybersecurity

Published April 17, 2026Original Report

Excerpt

DOWNLOAD PDF Severity: High CVSS Score: Not yet assigned (0-day local privilege escalation) Affected Systems: Windows 10, Windows 11, and Windows Server 2019+ with Microsoft Defender Antivirus real-time protection enabled (remains exploitable on systems with the April 2026 Patch Tuesday updates applied) Exploited in the Wild: Yes (confirmed by Huntress and other MDR providers as of April 16, 2026) Summary A publicly disclosed proof-of-concept (PoC) for a vulnerability…

Read the original report →

Attack Flow6 steps · MITRE ATT&CK mapped

Initial AccessTA0001T1190

1/6

Exploit Public-Facing Application

ActionExploit Defender vulnerability

Attackers leverage a zero-day vulnerability in Microsoft Defender to gain initial access.

Indicators of Compromise

Open the mindmap →

1 indicators

Type	Indicator	Confidence	Score	First Seen
CVE	CVE-2026-33825	High	Score 63/100	First seen Jun 2, 2026

IOC Relationship Graph

Building graph…