A Campaign Disables Microsoft Defender Before Dropping Ransomware

What cybersecurity researchers are reporting

The claim has been circulating since July 2, 2026: attackers are allegedly disabling Microsoft Defender, the log-monitoring tool Sysmon, and web application firewalls (WAFs) before deploying the credential-theft tool Mimikatz. This claim comes directly from the vulnerability intelligence report published by Threat-Modeling.com, a specialized cybersecurity source we were able to review directly.

This fact-check verifies every element of that claim: the exact nature of the technique, its connection to Defender's recent vulnerabilities, and the reliability of the source documenting it. Preliminary verdict: the claim is largely corroborated by the primary source, with a few technical nuances to add.

What the report precisely states

According to Threat-Modeling.com, the campaign follows a precise sequence: attackers first gain initial access to the targeted system, then disable all security monitoring, then harvest user credentials. The report calls this method a sophisticated "defensive kill chain," a technical term that precisely describes this type of cascading attack.

Verdict: TRUE. This description matches exactly what the primary source documents, with no exaggeration or shortcut. The three-stage sequence, access then neutralization then theft, is indeed the classic pattern for this type of attack, widely documented in specialized cybersecurity literature beyond this single report.

Why this sequence is especially dangerous

What makes this attack chain formidable isn't any single stage on its own, but how fast and coordinated the sequence is: once monitoring is neutralized, attackers operate almost blind to security teams, who lose their detection capability at the exact moment the attack becomes most damaging.

This technical reality confirms that detection speed remains the decisive factor in limiting the damage from a modern cyberattack, a principle this report illustrates concretely rather than theoretically.

BlueHammer, a confirmed ransomware vector

The report names two specific vulnerabilities affecting Microsoft Defender discovered in the same week: BlueHammer, a privilege escalation flaw tracked as CVE-2026-33825, confirmed by CISA as actively used in real ransomware campaigns.

Verdict: TRUE, with official confirmation. The fact that CISA, the U.S. cybersecurity agency, confirmed active exploitation of this flaw in real ransomware attacks gives this part of the claim considerable factual weight. This isn't a theoretical threat but a documented attack vector in the field.

RoguePlanet, a zero-day still without a full patch

The second vulnerability, dubbed RoguePlanet, is described by the report as a confirmed critical zero-day in the built-in antivirus that ships with every installation of Windows. Microsoft is reportedly working actively on a security patch, but the precise technical details of this flaw remain limited pending its official release.

Verdict: TRUE, but incomplete by nature. A zero-day, by definition, refers to a vulnerability that hasn't been patched at the time of its discovery, which explains why exhaustive technical details aren't yet publicly available. This limitation doesn't undermine the claim's truthfulness — it simply reveals its evolving nature.

An unusual concentration of critical vulnerabilities

The report notes that the discovery of two distinct critical vulnerabilities in Microsoft's built-in antivirus within 48 hours is an event it calls "unprecedented." BlueHammer was reportedly disclosed the day before RoguePlanet, according to the precise timeline established in the July 1 report.

Verdict: LIKELY TRUE, pending full historical verification. We could not independently confirm that no similar precedent exists in Microsoft Defender's history, but the specialized source, whose job is to track this type of event daily, states this exceptional nature with a degree of technical authority.

Why Defender's nature amplifies the risk

The report stresses an essential technical point: Defender runs with SYSTEM-level privileges and sits at Windows' deepest trust boundary. Every vulnerability affecting this component therefore represents a potential vector for total system compromise, not a minor flaw limited to some secondary feature.

Verdict: TRUE. This technical characterization of Defender's privilege level matches Windows' known and documented architecture. Security software with such privileges is indeed a prime target precisely because compromising it opens near-total access to the targeted system.

What experts concretely recommend

The report advises organizations to verify that Defender's tamper protection is enabled, which prevents unauthorized disabling, to monitor Windows event logs for security-service shutdowns, and to set up alerts on any change in Defender's or Sysmon's status.

Verdict: TECHNICALLY VALID RECOMMENDATIONS. These measures match standard industry best practices for this type of threat. They don't guarantee absolute protection, but they significantly reduce the window of opportunity attackers have to operate undetected.

The practical limits of these recommendations

That said, the technical enthusiasm needs tempering: not every organization, especially small operations without a dedicated security team, necessarily has the human and technical resources to implement continuous monitoring of these event logs. The recommendation is technically sound, but its universal applicability is debatable.

This practical limitation doesn't make the recommendation wrong — it simply highlights a persistent gap between theoretical cybersecurity best practices and the real capabilities of the most vulnerable organizations, often the least equipped to defend themselves.

An old tool that's still devastatingly effective

The claim that attackers use Mimikatz to siphon credentials once monitoring is disabled rests on a well-established industry fact: this tool, originally developed for security demonstration purposes, remains one of the most widely used credential-theft utilities in real attacks for more than a decade.

Verdict: TRUE and consistent with established trends. The persistence of Mimikatz as a go-to tool, despite its relative age in the threat landscape, is no surprise to anyone following this field: its effectiveness at extracting in-memory credentials remains largely intact against standard defenses not specifically configured to detect it.

What this reveals about organizations' defensive maturity

The fact that such a well-known and documented tool continues to work effectively in contemporary attacks points to a problem bigger than just Defender's vulnerabilities: many organizations still haven't deployed the specific defensive configurations that would let them effectively detect or block Mimikatz use on their systems.

This observation, while not explicitly stated that way in the source report, follows logically from the facts it presents: the defensive technology exists, but its actual deployment remains uneven across organizations.

What the report criticizes about official communication

The report from Threat-Modeling.com notes that Microsoft has not published a precise timeline for a full RoguePlanet patch, offering only generic acknowledgments through its Microsoft Security Response Center. This lack of transparency on timing feeds uncertainty among security officers who, in the meantime, must apply temporary mitigations rather than a definitive fix.

Verdict: TRUE, but needs nuance. It is common, and even recommended by industry best practice, for vendors not to disclose precise technical details about a patch in progress before its release, in order to avoid handing attackers a roadmap. Microsoft's relative silence isn't necessarily a fault, but it remains frustrating for security teams having to manage risk under uncertainty.

Comparable precedents at other vendors

This dynamic isn't unique to Microsoft: other tech giants like Google and Apple have, in the past, adopted similar staged disclosure policies for critical zero-day vulnerabilities, prioritizing operational security over immediate transparency toward the general public.

Verdict: CONTEXT CONFIRMED. The practice of responsible disclosure, which limits public information until a patch is ready, is a widely accepted norm in the cybersecurity industry, even if it legitimately frustrates system administrators on the front lines against the threat.

What the report says, and especially what it doesn't

A close read of the Threat-Modeling.com report reveals an important limitation: the document provides no precise figures on how many organizations have been affected, nor the identity of the ransomware groups involved in this specific campaign. This lack of quantitative data doesn't discredit the claim, but it does limit its exact factual scope.

Verdict: INCOMPLETE INFORMATION, NOT FALSE. It would be dishonest to claim this campaign hit a specific number of victims without a source confirming it. What can be stated with certainty is that the technique exists, is documented, and that the exploited vulnerabilities are real and confirmed by CISA.

Why this methodological caution matters

This distinction between a confirmed technique and a still-unclear scale illustrates precisely why a rigorous fact-check must resist the temptation to amplify a threat beyond what the sources actually allow us to establish, even when the topic is legitimately concerning for Western organizations' security.

This rigor in no way diminishes the seriousness of the documented threat: it simply clarifies its factual boundaries, allowing security officers to prioritize their efforts on solid ground rather than poorly calibrated panic.

A claim largely corroborated by a reliable specialized source

After verifying every component of this claim, our overall verdict is as follows: the core of the claim is TRUE and well documented by the report from Threat-Modeling.com, itself backed by CISA confirmations regarding the active exploitation of the BlueHammer flaw. The attack chain described, the critical nature of both Defender vulnerabilities, and Mimikatz's role in credential theft all correspond to technically consistent and corroborated facts.

The only reservation concerns the full technical details of RoguePlanet, still limited due to its nature as an incompletely patched zero-day, a limitation inherent to this type of discovery rather than a weakness of the information source itself.

What organizations should take away

Beyond the factual verdict, this fact-check confirms an urgent operational reality: organizations using Windows and Microsoft Defender should treat this information as a legitimate warning signal justifying an immediate review of their security posture, rather than as just another technical curiosity in the constant stream of cybersecurity reports.

By Maxime Marquette, columnist

Editorial stance

I am not a journalist but a columnist and analyst. My expertise lies in observing and analysing the geopolitical, economic and strategic dynamics that shape our world. My work is to take political strategies apart, to understand global economic movements, to put the decisions of international actors in context and to offer analytical perspectives on the changes that are redefining our societies.

I do not claim the cold objectivity of traditional journalism, which stops at reporting facts. I claim analytical clarity, rigorous interpretation and a deep understanding of the complex issues that concern us all. My role is to give meaning to the facts, to place them in their historical and strategic context, and to offer a critical reading of events.

Method and sources

This text keeps the basic distinction between verified facts and interpretive analysis. The rule never changes: a factual claim is published only when a verifiable source supports it, and the sources this article actually used are listed under Sources, never here.

Primary source families used by the publication, when the story has them: official statements from governments and international institutions, public statements by political leaders, reports from intergovernmental organisations, dispatches from recognised international news agencies.

Secondary source families: specialised publications, internationally recognised news media, analyses from established research institutions, reports from industry organisations.

When an article cites statistical, economic or geopolitical data, it comes from the institutions that produce it (intergovernmental organisations, central banks, national statistics offices), and the exact institution is named under Sources.

Nature of the analysis

The analyses, interpretations and perspectives in the analytical sections of this article are a critical, contextual synthesis based on the information available, the trends observed and the expert comments cited in the sources consulted.

My role is to interpret these facts, to set them in the context of today's geopolitical and economic dynamics, and to give them a coherent meaning within the larger story of the changes shaping our time. These analyses reflect expertise built through continuous observation of international affairs and an understanding of the strategic mechanisms that drive global actors.

This article describes a documented state of affairs on its publication date, not a prediction: later developments may shift its outlook. No update is promised in advance; when an article is corrected or completed, the change is dated in the text.