RedSun Exploit SyncRootManager Registration

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•13

Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value in the RedSun exploit (CVE-2026-41091).