PipeMagic Trojan Exploits Windows Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-28252 | Heap Overflow in Microsoft Windows CLFS Driver Enables Local Privilege Escalation CVE-2023-28252 is a heap-based buffer overflow (CWE-122) in the Microsoft Windows Common Log File System (CLFS) driver that allows privilege escalation. The flaw is triggered when the kernel's CLFS driver processes malformed or maliciously crafted log file data, corrupting heap memory; an attacker who can already run code on a target system (e.g., a low-privileged user or an attacker chained with another flaw such as a remote code execution bug) can leverage it to gain SYSTEM-level privileges. Because the CLFS driver ships with supported Windows client and server releases, essentially the entire Windows installed base is potentially exposed. The vulnerability is being actively exploited: CISA added it to the KEV catalog on 2023-04-11 with known ransomware use, and EPSS estimates a 49.0% probability of exploitation within 30 days (99th percentile). It was addressed in Microsoft's April 2023 security updates, and the required remediation action is to apply the vendor updates. Do: Apply Microsoft's April 2023 (or later) cumulative security updates to all Windows clients and servers per vendor instructions, prioritizing high-value and domain infrastructure systems given the known ransomware use; there is no public PoC or known workaround, so patching is the primary mitigation. Note that this is a local elevation-of-privilege flaw, so also hunt for prior low-privilege access or exploitation chains on hosts, and confirm remediation by checking installed update levels across the estate. | 7.8 | 49% | KEV ransomware PoC |
| masshundreds of millions of Windows devices (the CLFS driver is present across essentially all modern Windows 10/11 and Windows Server installations) | |
| CVE-2025-24983 | Windows Win32k Use-After-Free Privilege Escalation Zero-Day (CVE-2025-24983) CVE-2025-24983 is a use-after-free memory-safety flaw (CWE-416) in the Windows Win32 kernel (Win32k) subsystem that allows an attacker who already has limited local access on a Windows machine to elevate privileges; it requires low privileges and no user interaction but carries high attack complexity (CVSS 3.1: 7.0). Because it is a local elevation-of-privilege bug rather than remote code execution, it is typically used to deepen control after an initial foothold, and the high attack complexity makes exploitation less turnkey than typical Win32k EoP bugs. Microsoft shipped fixes among 57 March 2025 Patch Tuesday updates on March 11, 2025, flagging this as one of six actively exploited zero-days, and CISA added it to the Known Exploited Vulnerabilities catalog the same day (ransomware use: unknown). Anyone running the affected legacy releases — Windows 10 1507 and 1607 and Windows Server 2008, 2012, and 2016 — without the March 2025 updates is exposed, especially environments where multiple or less-trusted users can log on locally. No public proof-of-concept is known and EPSS puts the 30-day exploitation probability at about 1.3%; note that same-cycle headlines about a Windows zero-day exploited in ransomware attacks on US real estate firms (PipeMagic trojan) cover the March Patch Tuesday zero-days without the provided data confirming that CVE-2025-24983 specifically was the one used in those ransomware attacks. Do: Apply the March 2025 Patch Tuesday security updates (released March 11, 2025) to every affected Windows 10 1507/1607 and Windows Server 2008/2012/2016 host, since in-the-wild exploitation is confirmed and no public PoC or workaround details are available. Prioritize systems where untrusted or semi-trusted users can log on locally, and confirm compliance with CISA BOD 22-01 requirements for federal systems. After patching, hunt for signs of prior compromise (unexpected local administrator activity, suspicious service or task creation) because an EoP bug of this type is usually exercised after an initial foothold. | 7.0 | 1% | KEV |
| mass≈tens of millions of Windows endpoints and servers on the affected legacy editions | |
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) CVE-2025-29824 is a use-after-free flaw (CWE-416) in the Windows Common Log File System (CLFS) kernel driver, scored 7.8 (High) with a local attack vector, low privileges required, and no user interaction. An authorized local attacker can trigger it by interacting with CLFS-managed log files in a way that references freed kernel memory. Successful exploitation elevates the attacker's local privileges, typically to SYSTEM, providing full control of the host that can be chained into ransomware deployment or lateral movement. Any unpatched system running the listed Windows 10, Windows 11, or Windows Server versions is affected. The flaw was exploited as a zero-day — reportedly by Play ransomware — before Microsoft shipped fixes in the April 2025 Patch Tuesday release; it was added to CISA's KEV catalog on 2025-04-08 with known ransomware use, and EPSS estimates a 13.9% probability of continued exploitation over 30 days (96th percentile). Do: Apply Microsoft's April 2025 Patch Tuesday security updates for your Windows version immediately — the vendor update is the only complete fix, and the flaw is on the KEV list with known ransomware use, so prioritize servers and endpoints used by privileged users. Until patched, limit untrusted local code execution and review hosts for post-exploitation privilege escalation; public detection and mitigation scripts (e.g., Vicarius) are available to help hunt for exploitation. Federal agencies must apply the vendor mitigations per BOD 22-01 deadlines or discontinue use of affected versions. | 7.8 | 14% | KEV ransomware PoC ×2 |
| massHundreds of millions of Windows devices worldwide |
Full article540 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananApr 09, 2025Vulnerability / Ransomware
Microsoft has revealed that a now-patched security flaw impacting the Windows Common Log File System (CLFS) was exploited as a zero-day in ransomware attacks aimed at a small number of targets.
"The targets include organizations in the information technology (IT) and real estate sectors of the United States, the financial sector in Venezuela, a Spanish software company, and the retail sector in Saudi Arabia," the tech giant said.
The vulnerability in question is CVE-2025-29824, a privilege escalation bug in CLFS that could be exploited to achieve SYSTEM privileges. It was fixed by Redmond as part of its Patch Tuesday update for April 2025.
Microsoft is tracking the activity and the post-compromise exploitation of CVE-2025-29824 under the moniker Storm-2460, with the threat actors also leveraging a malware named PipeMagic to deliver the exploit as well as ransomware payloads.
The exact initial access vector used in the attacks is currently not known. However, the threat actors have been observed using the certutil utility to download malware from a legitimate third-party site that was previously compromised to stage the payloads.
The malware is a malicious MSBuild file that contains an encrypted payload, which is then unpacked to launch PipeMagic, a plugin-based trojan that has been detected in the wild since 2022.
It's worth mentioning here that CVE-2025-29824 is the second Windows zero-day flaw to be delivered via PipeMagic after CVE-2025-24983, a Windows Win32 Kernel Subsystem privilege escalation bug, which was flagged by ESET and patched by Microsoft last month.
Previously, PipeMagic was also observed in connection with Nokoyawa ransomware attacks that exploited another CLFS zero-day flaw (CVE-2023-28252).
"In some of the other attacks that we attribute to the same actor, we also observed that, prior to exploiting the CLFS elevation-of-privilege vulnerability, the victim's machines were infected with a custom modular backdoor named 'PipeMagic' that gets launched via an MSBuild script," Kaspersky pointed out in April 2023.
It's crucial to note that Windows 11, version 24H2, is not affected by this specific exploitation, as access to certain System Information Classes within NtQuerySystemInformation is restricted to users with SeDebugPrivilege, which typically only admin-like users can obtain.
"The exploit targets a vulnerability in the CLFS kernel driver," the Microsoft Threat Intelligence team explained. "The exploit then utilizes a memory corruption and the RtlSetAllBits API to overwrite the exploit process's token with the value 0xFFFFFFFF, enabling all privileges for the process, which allows for process injection into SYSTEM processes."
Successful exploitation is followed by the threat actor extracting user credentials by dumping the memory of LSASS and encrypting files on the system with a random extension.
Microsoft said it was unable to obtain a ransomware sample for analysis, but said that the ransom note dropped after encryption included a TOR domain tied to the RansomEXX ransomware family.
"Ransomware threat actors value post-compromise elevation of privilege exploits because these could enable them to escalate initial access, including handoffs from commodity malware distributors, into privileged access," Microsoft said. "They then use privileged access for widespread deployment and detonation of ransomware within an environment."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/04/pipemagic-trojan-exploits-windows-clfs.html