Malwarehigh
PipeMagic in 2025: How the backdoor operators’ tactics have changed
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-0144 | Remote Code Execution in Microsoft SMBv1 (EternalBlue) affecting Windows and Siemens devices | 8.8 | 99% | KEVRansomwarePoC ×6 | KEV |
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) | 7.8 | 19% | KEVRansomwarePoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | bi.zone | specifics of this vulnerability were analyzed in detail by BI.ZONE in the second part of our joint research . IoCs Domains aaa |
| md5 | 1a119c23e8a71bf70c1e8edf948d5181 | he 2024 attacks involving a ChatGPT client. Deployed PE MD5 1a119c23e8a71bf70c1e8edf948d5181 File name – In all the loading methods described above, the |
| md5 | 5df8ee118c7253c3e27b1e427b56212c | ater, we also found the backdoor itself. Initial loader MD5 5df8ee118c7253c3e27b1e427b56212c File name metafile.mshi In this attack, the loader was a Mi |
| md5 | 60988c99fb58d346c9a6492b9f3a67f7 | ty – when launched, it simply displayed a blank screen. MD5 60988c99fb58d346c9a6492b9f3a67f7 File name chatgpt.exe Blank screen of the fake application |
| md5 | 7e6bf818519be0a20dbc9bcb9e5728c6 | e parsing and FNV-1a hashing are used. Loader (ChatGPT) MD5 7e6bf818519be0a20dbc9bcb9e5728c6 File name chatgpt.exe In 2025, we also found PipeMagic load |
| md5 | bddaf7fae2a7dac37f5120257c7c11ba | 9c3152251 googleupdate.dll 1a119c23e8a71bf70c1e8edf948d5181 bddaf7fae2a7dac37f5120257c7c11ba Pipe names \.\pipe\0104201.%d \\.\pipe\1.<16-byte hexadecim |
| md5 | e3c8480749404a45a61c39d9c3152251 | ypting the payload using AES Loader using DLL hijacking MD5 e3c8480749404a45a61c39d9c3152251 File name googleupdate.dll In addition to the initial execu |
| sha256 | 4829468622e6b82ff056e3c945dd99c94a1f0264d980774828aadda326b775e5 | which is encrypted with the RC4 stream cipher using the key 4829468622e6b82ff056e3c945dd99c94a1f0264d980774828aadda326b775e5 (hex string). After decryption, the resulting shellcode is |
From the original article
10 min read at securelist.com
In April 2025, Microsoft patched 121 vulnerabilities in its products. According to the company, only one of them was being used in real-world attacks at the time the patch was released: CVE-2025-29824. The exploit for this vulnerability was executed by the PipeMagic malware, which we first discovered in December 2022 in a RansomExx ransomware campaign.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.