Aug 18, 2025Ravie LakshmananVulnerability / Cloud Safety
Cybersecurity researchers have lifted the lid on the menace actors’ exploitation of a now-patched safety flaw in Microsoft Home windows to deploy the PipeMagic malware in RansomExx ransomware assaults.
The assaults contain the exploitation of CVE-2025-29824, a privilege escalation vulnerability impacting the Home windows Widespread Log File System (CLFS) that was addressed by Microsoft in April 2025, Kaspersky and BI.ZONE stated in a joint report printed in the present day.
PipeMagic was first documented in 2022 as a part of RansomExx ransomware assaults concentrating on industrial firms in Southeast Asia, able to performing as a full-fledged backdoor offering distant entry and executing a variety of instructions on compromised hosts.
In these assaults, the menace actors have been discovered to use CVE-2017-0144, a distant code execution flaw in Home windows SMB, to infiltrate sufferer infrastructure. Subsequent an infection chains noticed in October 2024 in Saudi Arabia have been noticed leveraging a pretend OpenAI ChatGPT app as bait to ship the malware.
Earlier this April, Microsoft attributed the exploitation of CVE-2025-29824 and the deployment of PipeMagic to a menace actor it tracks as Storm-2460.
“One distinctive function of PipeMagic is that it generates a random 16-byte array used to create a named pipe formatted as: .pipe1.<hex string>,” researchers Sergey Lozhkin, Leonid Bezvershenko, Kirill Korchemny, and Ilya Savelyev stated. “After that, a thread is launched that constantly creates this pipe, makes an attempt to learn information from it, after which destroys it. This communication methodology is important for the backdoor to transmit encrypted payloads and notifications.”
PipeMagic is a plugin-based modular malware that makes use of a website hosted on the Microsoft Azure cloud supplier to stage the extra elements, with 2025 assaults geared toward Saudi Arabia and Brazil counting on a Microsoft Assist Index file (“metafile.mshi”) as a loader. The loader, in flip, unpacks C# code that decrypts and executes embedded shellcode.
“The injected shellcode is executable code for 32-bit Home windows methods,” the researchers stated. “It hundreds an unencrypted executable embedded contained in the shellcode itself.”
Kaspersky stated it additionally uncovered PipeMagic loader artifacts masquerading as a ChatGPT shopper in 2025 which might be much like these beforehand seen in October 2024. The samples have been noticed leveraging DLL hijacking methods to run a malicious DLL that mimics a Google Chrome replace file (“googleupdate.dll”).
No matter the loading methodology used, all of it results in the deployment of the PipeMagic backdoor that helps varied modules –
Asynchronous communication module that helps 5 instructions to terminate the plugin, learn/write recordsdata, terminate a file operation, or terminate all file operations
Loader module to inject further payloads into reminiscence and execute them
Injector module to launch a C# executable
“The repeated detection of PipeMagic in assaults on organizations in Saudi Arabia and its look in Brazil point out that the malware stays lively and that the attackers proceed to develop its performance,” the researchers stated.
“The variations detected in 2025 present enhancements over the 2024 model, geared toward persisting in sufferer methods and shifting laterally inside inner networks. Within the 2025 assaults, the attackers used the ProcDump device, renamed to dllhost.exe, to extract reminiscence from the LSASS course of.”
