Exploitation of CLFS zero-day leads to ransomware activity
A zero-day elevation of privilege vulnerability in Windows Common Log File System (CLFS) has been exploited against targets in IT, real estate, finance, software, and retail sectors across multiple countries. The exploit, deployed by PipeMagic malware and attributed to Storm-2460, enables privilege escalation and ransomware deployment. The vulnerability, CVE-2025-29824, was patched on April 8, 2025. The attack involves downloading malicious MSBuild files, using PipeMagic, and exploiting CLFS to inject payloads into system processes. Post-exploitation activities include credential theft and ransomware deployment, with similarities to RansomEXX. Microsoft recommends immediate patching and provides mitigation strategies, detection methods, and hunting queries to counter this threat.
Pulse ID: 67f6b1c7251291d51de23a7a
Pulse Link: https://otx.alienvault.com/pulse/67f6b1c7251291d51de23a7a
Pulse Author: AlienVault
Created: 2025-04-09 17:43:35
Be advised, this data is unverified and should be considered preliminary. Always do further verification.