A recent report has highlighted the exploitation of a critical zero-day vulnerability (CVE-2025-29824) in the Windows Common Log File System (CLFS), which facilitates local privilege escalation. The threat actor group Storm-2460 has weaponized this vulnerability using the PipeMagic malware, affecting various organizations, including those in the IT, real estate, financial, and retail sectors across multiple regions. Microsoft’s security patch was released on April 8, 2025, emphasizing the urgency for organizations to update their systems. Affected: Spanish software company, Information Technology sector, Real Estate sector, Financial Sector in Venezuela, Retail Sector in Saudi Arabia
Keypoints :
- Active exploitation of CVE-2025-29824 allows local privilege escalation in Windows CLFS.
- Storm-2460 threat group is responsible for the exploitation using PipeMagic malware.
- Initial access often gained through commodity malware.
- Exploited systems include various Windows Server versions and Windows 10 editions.
- Malware downloads occur via compromised legitimate third-party websites.
- Post-compromise activities include deleting backups and modifying Boot Configuration Data (BCD).
- Microsoft has recommended prompt system patching to mitigate risks.
MITRE Techniques :
- T1210 – Exploitation of Remote Services: The exploit targets a vulnerability in CLFS to gain elevated privileges.
- T1566.001 – Phishing: Initial access is obtained through commodity malware.
- T1203 – Exploitation for Client Execution: The use of certutil to download malware-laden files via exploited websites.
- T1059.001 – Command and Scripting Interpreter: PowerShell is used alongside certutil for execution of downloaded files.
- T1071.001 – Application Layer Protocol: Malware employs C2 communication for further instruction.
Indicator of Compromise :
- [Domain] aaaaabbbbbbb.eastus.cloudapp.azure.com
- [File] C:ProgramDataSkyPDFPDUDrv.blf
- [Process] certutil.exe
- [Process] msbuild.exe
- [Process] procdump.exe
Full Story: https://www.logpoint.com/en/blog/emerging-threats/from-exploit-to-ransomware-detecting-cve-2025-29824/
Views: 30