Exploitation of CLFS zero-day leads to ransomware activity

SUMMARY :

A zero-day elevation of privilege vulnerability in the Windows Common Log File System (CLFS) has been exploited against targets in various sectors across multiple countries. The exploit, deployed by PipeMagic malware and attributed to Storm-2460, enables privilege escalation and ransomware deployment. Post-exploitation activities include credential theft and file encryption. The vulnerability, tracked as CVE-2025-29824, has been patched. Mitigation strategies include applying security updates, enabling cloud-delivered protection, and implementing advanced security measures. Multiple detection methods and hunting queries are provided for identifying and responding to this threat.

OPENCTI LABELS :

zero-day,ransomexx,clfs,pipemagic,cve-2025-29824


Open in NetmanageIT OpenCTI Public Instance with below link!


Use public read only username and password on login page.

NOTE : Use Public READ only user credentials on login page banner.


Exploitation of CLFS zero-day leads to ransomware activity