Microsoft has disclosed that a recently patched Windows Common Log File System (CLFS) vulnerability was exploited as a zero-day in targeted ransomware attacks. The security flaw, identified as CVE-2025-29824, allowed attackers to escalate privileges to SYSTEM level and was addressed in Microsoft’s April 2025 Patch Tuesday update.
## Targeted Sectors and Regions
The attacks specifically targeted organizations across multiple sectors and regions:
– IT and real estate sectors in the United States
– Financial institutions in Venezuela
– A software company in Spain
– Retail businesses in Saudi Arabia
## Attack Details
Microsoft is tracking this activity under the name Storm-2460. While the initial access vector remains unknown, the threat actors used a multi-stage attack process:
1. Compromised legitimate third-party websites to host malicious payloads
2. Used the certutil utility to download malware
3. Deployed malicious MSBuild files containing encrypted payloads
4. Launched PipeMagic, a plugin-based trojan active since 2022
The PipeMagic trojan has previously been linked to other zero-day exploits, including CVE-2025-24983 (a Windows Win32 Kernel Subsystem vulnerability) and CVE-2023-28252 (another CLFS flaw used in Nokoyawa ransomware attacks).
## Technical Exploitation
The exploit targets a vulnerability in the CLFS kernel driver, using memory corruption and the RtlSetAllBits API to overwrite the process’s token, enabling all privileges and allowing injection into SYSTEM processes.
After successful exploitation, attackers:
– Extracted credentials by dumping LSASS memory
– Encrypted files with random extensions
– Dropped a ransom note containing a TOR domain linked to the RansomEXX ransomware family
## Protection Note
Windows 11 version 24H2 is not affected by this specific exploit due to restricted access to certain System Information Classes within NtQuerySystemInformation.
Microsoft emphasized that ransomware actors particularly value privilege escalation exploits as they enable attackers to convert initial access into privileged access for widespread ransomware deployment.