Huntress documented a live intrusion in which attackers used publicly available privilege-escalation tools known as BlueHammer, RedSun, and UnDefend. The operation began with compromised FortiGate SSL VPN credentials, which gave the intruders access to the environment and allowed them to stage malicious binaries in user-writable folders. Once inside, they executed reconnaissance commands and deployed a custom Go-based tunneling utility called BeigeBurrow. The case highlights how proof-of-concept exploit tools can quickly move from public release into active intrusion activity.
The investigation traced the malicious activity to compromised FortiGate SSL VPN sessions originating from IP addresses in Russia, Singapore, and Switzerland. Analysts found binaries including FunnyApp.exe , RedSun.exe , undef.exe , and a Go-based tunneling agent named agent.exe stored in user Pictures and Downloads directories. The attackers also ran hands-on-keyboard commands such as whoami /priv , cmdkey /list , and net group to enumerate privileges and credentials. The tunneling agent established a yamux-based reverse tunnel to staybud.dpdns.org over port 443 to maintain remote access.
Defenders should monitor execution from unusual user-writable paths, detect the known binary names, and investigate Microsoft Defender alerts such as Exploit:Win32/DfndrPEBluHmr.BZ and EICAR-related detections. VPN logs should be reviewed for suspicious logins from widely separated geographies, and any untrusted source IPs should be blocked. Security teams should also deploy endpoint detections for BlueHammer, RedSun, and UnDefend activity and prioritize remediation for CVE-2026-33825 .
If this activity is detected, isolate the affected endpoint immediately, terminate the tunneling agent, and remove all staged binaries from the host. Reset compromised VPN credentials and enforce multi-factor authentication for remote access. Incident responders should also perform a full review for credential dumping, apply Microsoft’s patch for CVE-2026-33825 , and hunt across the environment for any remaining traces of the privilege-escalation tools.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands: An adversary that has obtained a foothold on a Windows host wishes to confirm the privilege level of the compromised account and enumerate stored credentials and domain groups for lateral movement. To stay under the radar, the attacker uses native Windows binaries ( whoami , cmdkey , net ) executed directly from a PowerShell prompt—avoiding any third‑party tools that would generate additional alerts. Each command creates a process, producing an Event ID 4688 record with the exact command line the Sigma rule watches for.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
