CISA Confirms Active Ransomware Exploitation of Windows BlueHammer Flaw

CISA confirmed that ransomware gangs are now actively exploiting “BlueHammer,” a privilege escalation vulnerability in Microsoft Defender that was previously abused in zero-day attacks. The flaw lets attackers escalate privileges on compromised Windows systems, a step ransomware operators commonly use before deploying their payload. Organizations still running unpatched Defender installations should treat this as urgent and apply available fixes immediately.