Cybersecurity researchers have lifted the lid on the risk actors’ exploitation of a now-patched security flaw in Microsoft Home windows to deploy the PipeMagic malware in RansomExx ransomware assaults.
The assaults contain the exploitation of CVE-2025-29824, a privilege escalation vulnerability impacting the Home windows Frequent Log File System (CLFS) that was addressed by Microsoft in April 2025, Kaspersky and BI.ZONE mentioned in a joint report printed right now.
PipeMagic was first documented in 2022 as a part of RansomExx ransomware assaults concentrating on industrial firms in Southeast Asia, able to performing as a full-fledged backdoor offering distant entry and executing a variety of instructions on compromised hosts.
In these assaults, the risk actors have been discovered to use CVE-2017-0144, a distant code execution flaw in Home windows SMB, to infiltrate sufferer infrastructure. Subsequent an infection chains noticed in October 2024 in Saudi Arabia have been noticed leveraging a pretend OpenAI ChatGPT app as bait to ship the malware.
Earlier this April, Microsoft attributed the exploitation of CVE-2025-29824 and the deployment of PipeMagic to a risk actor it tracks as Storm-2460.
“One distinctive characteristic of PipeMagic is that it generates a random 16-byte array used to create a named pipe formatted as: .pipe1.<hex string>,” researchers Sergey Lozhkin, Leonid Bezvershenko, Kirill Korchemny, and Ilya Savelyev mentioned. “After that, a thread is launched that constantly creates this pipe, makes an attempt to learn knowledge from it, after which destroys it. This communication technique is critical for the backdoor to transmit encrypted payloads and notifications.”
PipeMagic is a plugin-based modular malware that makes use of a website hosted on the Microsoft Azure cloud supplier to stage the extra parts, with 2025 assaults aimed toward Saudi Arabia and Brazil counting on a Microsoft Assist Index file (“metafile.mshi”) as a loader. The loader, in flip, unpacks C# code that decrypts and executes embedded shellcode.
“The injected shellcode is executable code for 32-bit Home windows programs,” the researchers mentioned. “It masses an unencrypted executable embedded contained in the shellcode itself.”
Kaspersky mentioned it additionally uncovered PipeMagic loader artifacts masquerading as a ChatGPT shopper in 2025 which are much like these beforehand seen in October 2024. The samples have been noticed leveraging DLL hijacking methods to run a malicious DLL that mimics a Google Chrome replace file (“googleupdate.dll”).
No matter the loading technique used, all of it results in the deployment of the PipeMagic backdoor that helps numerous modules –
- Asynchronous communication module that helps 5 instructions to terminate the plugin, learn/write recordsdata, terminate a file operation, or terminate all file operations
- Loader module to inject extra payloads into reminiscence and execute them
- Injector module to launch a C# executable
“The repeated detection of PipeMagic in assaults on organizations in Saudi Arabia and its look in Brazil point out that the malware stays lively and that the attackers proceed to develop its performance,” the researchers mentioned.
“The variations detected in 2025 present enhancements over the 2024 model, aimed toward persisting in sufferer programs and transferring laterally inside inner networks. Within the 2025 assaults, the attackers used the ProcDump software, renamed to dllhost.exe, to extract reminiscence from the LSASS course of.”
