CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks

Key facts for Storm-2460 CLFS PipeMagic chain

Detection coverage for Storm-2460 CLFS PipeMagic chain

As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1543 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Renamed ProcDump LSASS Access via dllhost.exe with Anti-Recovery Command Burst

Detects the post-exploitation phase of the Storm-2460/PipeMagic chain: a renamed/repurposed Sysinternals procdump.exe masquerading as dllhost.exe dumping LSASS memory for credential theft, combined with the rapid-succession anti-recovery command burst (bcdedit/wbadmin/wevtutil) that precedes RansomEXX detonation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1003.001, T1490, T1070.001, T1036.003
• Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\dllhost.exe" CommandLine="*-accepteula*" CommandLine="*-ma*" CommandLine="*lsass.exe*")
OR (Image="*\\bcdedit.exe" CommandLine="*recoveryenabled no*")
OR (Image="*\\wbadmin.exe" CommandLine="*delete catalog*")
OR (Image="*\\wevtutil.exe" CommandLine="*cl *")
| eval technique=case(match(CommandLine,"lsass"),"T1003.001",match(Image,"bcdedit"),"T1490",match(Image,"wbadmin"),"T1490",match(Image,"wevtutil"),"T1070.001")
| stats count values(technique) as techniques values(CommandLine) as commands earliest(_time) as first_seen latest(_time) as last_seen by Computer, User
| where count >= 1

Microsoft KQL

let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where (FileName =~ "dllhost.exe" and ProcessCommandLine has "-accepteula" and ProcessCommandLine has "-ma" and ProcessCommandLine has "lsass")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled no")
   or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete catalog")
   or (FileName =~ "wevtutil.exe" and ProcessCommandLine has "cl ")
| extend MitreTechnique = case(ProcessCommandLine has "lsass", "T1003.001", FileName =~ "bcdedit.exe", "T1490", FileName =~ "wbadmin.exe", "T1490", "T1070.001")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, MitreTechnique
| sort by Timestamp asc

Sigma

title: Renamed ProcDump Targeting LSASS via dllhost.exe (Storm-2460/PipeMagic Pattern)
id: 8f2a1c40-1543-4b1e-9f00-tlintel1543a
status: experimental
description: Detects a renamed/repurposed Sysinternals procdump.exe invoked as dllhost.exe to dump LSASS process memory, matching the Storm-2460/PipeMagic post-CVE-2025-29824 credential-theft pattern
references:
    - https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.impact
    - attack.t1490
    - attack.defense-evasion
    - attack.t1070.001
    - attack.tool.procdump
    - cve.2025.29824
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\dllhost.exe'
    selection_cmdline:
        CommandLine|contains|all:
            - '-accepteula'
            - '-ma'
            - 'lsass.exe'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains: 'recoveryenabled no'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    selection_wevtutil:
        Image|endswith: '\wevtutil.exe'
        CommandLine|contains: 'cl '
    condition: (selection_image and selection_cmdline) or 1 of selection_bcdedit or selection_wbadmin or selection_wevtutil
falsepositives:
    - Legitimate COM Surrogate activity is extremely unlikely to include ProcDump-style flags
    - Legitimate backup/log-management maintenance scripts (rare in combination within a short window)
level: critical

Known false positives:

• Legitimate IT-administered backup/log-rotation maintenance scripts running bcdedit/wbadmin/wevtutil in combination; authorized incident-response memory captures using renamed tooling under change control

Tuning notes: Correlate the LSASS-access marker and the anti-recovery command burst within a 10-minute window per host to raise confidence to critical; allowlist known backup-job service accounts that legitimately run wbadmin/wevtutil on a schedule.

• 🔒 Cisco ASA Edge-Device Compromise Followed by Windows CLFS Exploitation Chain · unlock with TL Creds
• 🔒 Process Injection into winlogon.exe/dllhost.exe with Subsequent Reconnaissance Burst · unlock with TL Creds
• 🔒 RansomEXX Detonation via dllhost.exe Payload Launcher with Ransom-Note Drop · unlock with TL Creds
• 🔒 Renamed ProcDump Targeting LSASS via dllhost.exe (Storm-2460/PipeMagic Pattern) · unlock with TL Creds
• 🔒 Anti-Recovery Command Sequence Preceding Ransomware Detonation · unlock with TL Creds
• 🔒 PipeMagic WebSocket-Style HTTP Beacon to Azure Cloud App Service C2 · unlock with TL Creds
• 🔒 CVE-2025-29824 Exploitation Chain — LOLBin Staging and Anomalous CLFS BLF Artifact · unlock with TL Creds
• 🔒 PipeMagic Named-Pipe C2 Naming Convention and Azure Cloud App C2 Egress · unlock with TL Creds

Indicators of compromise for Storm-2460 CLFS PipeMagic chain

As of 2026-09-10, Threadlinqs Intelligence tracks 31 indicators of compromise for TL-2026-1543.

Sample indicators (3 of 31)

• Domain: aaaaabbbbbbb[.]eastus[.]cloudapp[.]azure[.]com
• File hash: 6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05
• File hash: 858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe

Defanged, TLP:CLEAR. Full set of 31 indicators: unlock with TL Creds.

How Storm-2460 CLFS PipeMagic chain works

CVE-2025-29824 is a local privilege-escalation vulnerability in clfs.sys, the kernel-mode driver implementing the Windows Common Log File System. The root cause is a race condition in reference-count handling of the 0x110-byte CClfsLogCcb structure (referenced as FsContext2 by the I/O manager): when a log file handle is closed, CClfsRequest::Cleanup() called CClfsLogCcb::Release(FsContext2) prematurely, while other in-flight IRPs dispatched through DeviceIoControl() (ReserveAndAppendLog — IOCTL 0x8007A827, WriteRestart — IOCTL 0x8007281F, ReadArchiveMetadata — IOCTL 0x80076856) could still reference the same structure. An attacker who opens a CLFS log handle, spawns two threads, and races a targeted DeviceIoControl() call against a concurrent CloseHandle() can force one thread to dereference freed pool memory, yielding a controlled use-after-free that is escalated into arbitrary kernel memory corruption and ultimately a token-privilege overwrite (RtlSetAllBits used to set the token's enabled/present privilege bitmask to 0xFFFFFFFF, i.e. full SYSTEM privileges). Microsoft's fix relocated the Release(FsContext2) call from Cleanup() to Close(), ensuring no active request can reference the structure during deallocation (clfs.sys pre-patch build 10.0.22621.5097, post-patch build 10.0.22621.5192). The bug affects Windows 10, Windows 11 (up to and tested on 23H2; ineffective against 24H2 which additionally requires SeDebugPrivilege), and Windows Server 2008 through 2025.

The vulnerability was exploited in the wild before patch availability. Microsoft attributed a ransomware campaign to Storm-2460, a financially motivated actor that used the PipeMagic modular backdoor (first documented by Kaspersky in October 2024, distributed via a trojanized open-source ChatGPT Desktop Application project on GitHub) for pre-exploitation staging. Storm-2460 abused certutil.exe to download an encrypted payload disguised as a malicious MSBuild project file hosted on a previously compromised, legitimate third-party website; execution decrypted the embedded payload via an EnumCalendarInfoA API callback trick, ultimately loading PipeMagic in memory. PipeMagic then launched an in-memory CVE-2025-29824 exploit from dllhost.exe, using NtQuerySystemInformation for kernel address disclosure and creating a CLFS BLF artifact at C:\ProgramData\SkyPDF\PDUDrv.blf during exploitation. Post-exploitation, the actor injected code into winlogon.exe, used a renamed/repurposed Sysinternals procdump.exe (`dllhost.exe -accepteula -r -ma lsass.exe c:\programdata\[random].dmp`) to dump LSASS memory for credential theft, performed defense evasion (disabling recovery via bcdedit, deleting the Windows backup catalog via wbadmin, clearing the Application event log via wevtutil), and deployed RansomEXX ransomware (launched via `dllhost.exe --do [path]`, dropping a ransom note named `!_READ_ME_REXX2_!.txt` and referencing RansomEXX-linked .onion payment sites). PipeMagic's C2 infrastructure used the Azure-hosted domain aaaaabbbbbbb.eastus.cloudapp.azure[.]com (subsequently disabled) and communicated over a WebSocket-style HTTP channel with spoofed browser headers. Internally PipeMagic organizes payload/execute/network/auxiliary doubly linked lists of RC4-encrypted (32-byte hardcoded keys), aPLib-compressed, SHA-1-validated PE modules exchanged over a named pipe of the form \\.\pipe\1.<Bot_ID_hex>. ESET research has linked PipeMagic activity to exploitation of a related Win32k vulnerability, CVE-2025-24983.

Separately, Symantec/Broadcom (Security.com) reported that Balloonfly — the threat actor operating the Play ransomware-as-a-service operation — deployed the CVE-2025-29824 exploit prior to public disclosure in an intrusion against a U.S. organization where the likely initial-access vector was a public-facing, compromised Cisco ASA firewall appliance. In that intrusion no ransomware payload was ultimately deployed, but the actor dropped the Grixba infostealer (a custom reconnaissance/credential-harvesting tool associated with Balloonfly/Play) alongside assorted hacktools and the local privilege-escalation exploit, illustrating the broader pattern of Cisco ASA edge-device compromise for initial access followed by CVE-2025-29824 for privilege escalation ahead of ransomware detonation. Microsoft has stated the vulnerability carries meaningful risk of widespread ransomware deployment and detonation given its role as a reliable, patch-gap privilege-escalation primitive usable by multiple independent ransomware affiliates.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003 OS Credential Dumping; T1003.001 OS Credential Dumping: LSASS Memory; T1003.002 OS Credential Dumping: Security Account Manager

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1087.002 Account Discovery: Domain Account

Defense Evasion

T1036 Masquerading; T1036.005 Masquerading: Match Legitimate Name or Location; T1055 Process Injection; T1070 Indicator Removal; T1070.001 Indicator Removal: Clear Windows Event Logs; T1112 Modify Registry; T1140 Deobfuscate/Decode Files or Information; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1203 Exploitation for Client Execution; T1569 System Services

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools

Remediation for Storm-2460 CLFS PipeMagic chain

Patches

• Microsoft Windows security update, April 8, 2025 (clfs.sys build 10.0.22621.5192 or later on Windows 11 23H2; equivalent builds for other supported versions)

Immediate actions

• Apply Microsoft's April 8, 2025 security update for CVE-2025-29824 to all Windows 10, Windows 11, and Windows Server 2008-2025 hosts
• Patch or isolate internet-facing Cisco ASA firewalls; review Cisco security advisories for the ASA/FTD zero-days used for initial access
• Hunt for C:\ProgramData\SkyPDF\PDUDrv.blf and other anomalous .blf artifacts outside normal CLFS log paths
• Hunt for renamed procdump.exe invocations targeting lsass.exe and process injection into winlogon.exe/dllhost.exe
• Block/monitor egress to aaaaabbbbbbb.eastus.cloudapp.azure[.]com and the associated RansomEXX .onion payment sites

Workarounds

• Restrict local logon/console access on high-value Windows hosts; monitor and restrict certutil.exe network usage via application control policies

Longer-term hardening

• Deploy EDR with kernel-mode exploit and LSASS-access behavioral detection
• Enforce least-privilege on standard user accounts to reduce local privilege-escalation blast radius
• Implement network segmentation isolating perimeter firewall management planes from internal Windows infrastructure
• Establish rapid out-of-band patch deployment SLAs for kernel driver elevation-of-privilege advisories tied to active exploitation

Affected and fixed versions

• Microsoft — Windows CLFS Driver (clfs.sys)
  Vulnerable versions: Windows 10; Windows 11 (up to 23H2); Windows Server 2008; Windows Server 2012; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025
  Fixed in: clfs.sys 10.0.22621.5192 and later (Windows 11 23H2); April 8, 2025 cumulative updates for all affected versions
• Cisco — Adaptive Security Appliance (ASA) / Firepower Threat Defense (FTD)
  Vulnerable versions: Internet-facing ASA/FTD appliances exploited via separate, unpatched vulnerabilities used as initial access in the Balloonfly intrusion
  Fixed in: Refer to Cisco security advisories cisco-sa-asaftd-webvpn-z5xP8EUB and cisco-sa-asaftd-persist-CISAED25-03

Timeline of Storm-2460 CLFS PipeMagic chain

Last updated 2026-09-10 · revalidated 1× · latest source

• 2023-03-01 locked-ioc-28 is first used in the wild to deliver a Win32k Kernel Subsystem zero-day exploit (later designated CVE-2025-24983) against Windows 8.1 and Windows Server 2012 R2, roughly two years before the CLFS zero-day activity.
• 2024-10-01 Kaspersky publicly documents the locked-ioc-28 modular backdoor for the first time, distributed via a trojanized open-source ChatGPT Desktop Application project on GitHub
• 2025-03-11 Microsoft's March 2025 Patch Tuesday fixes CVE-2025-24983 (Win32k Kernel Subsystem use-after-free, CVSS 7.0), the first of two Windows kernel zero-days delivered via locked-ioc-28; exploited in the wild for roughly two years before the patch.
• 2025-04-08 CISA adds CVE-2025-29824 to the Known Exploited Vulnerabilities catalog the same day Microsoft patches it, invoking BOD 22-01 remediation requirements for FCEB agencies.
• 2025-04-08 Microsoft releases security updates patching CVE-2025-29824 (clfs.sys build 10.0.22621.5192+ on Windows 11 23H2) and publishes a blog attributing in-the-wild exploitation to Storm-2460 using locked-ioc-28 to deploy ransomware
• 2025-04-09 The Hacker News, Cybersecurity Dive, and TechRepublic report on the locked-ioc-28/CLFS zero-day ransomware campaign, noting Microsoft's warning about risk of widespread ransomware detonation
• 2025-04-10 Logpoint publishes detection guidance covering the exploit-to-ransomware chain for CVE-2025-29824
• 2025-04-22 Symantec/Broadcom (Security.com) discloses that Balloonfly (Play ransomware operators) deployed the CVE-2025-29824 exploit before public disclosure in a U.S. intrusion that began with a compromised public-facing Cisco ASA firewall, alongside the locked-ioc-31 infostealer
• 2025-04-29 CISA's BOD 22-01 remediation due date for CVE-2025-29824 for U.S. Federal Civilian Executive Branch (FCEB) agencies.
• 2025-05-01 BI.ZONE publishes an independent technical deep dive into the CVE-2025-29824 CLFS vulnerability and exploitation mechanics
• 2025-07-16 Star Labs publishes "My 'Blind Date' with CVE-2025-29824", a detailed root-cause and exploitation-mechanics writeup covering the FsContext2/CClfsLogCcb use-after-free and the pre/post patch behavior of CClfsRequest::Cleanup()
• 2025-08-18 Microsoft Security publishes an in-depth architectural analysis of the locked-ioc-28 backdoor, detailing its plugin/module linked-list system, RC4/aPLib module handling, and named-pipe C2 protocol, and connects related activity to CVE-2025-24983 (Win32k) per ESET research

Update history

• 2026-09-10 — CVE-2025-29824: Windows CLFS Driver Use-After-Free Exploited In-the-Wild for Privilege Escalation After Cisco ASA Compromise: What changed No field escalations — severity (HIGH), exploitability (ACTIVE), status (ACTIVE), CVSS (7.8), and attribution confidence (MEDIUM) are unchanged. The newer report enriches the record: CVE-2025-29824 was added to CISA's KEV catal

Sources cited for Storm-2460 CLFS PipeMagic chain

• CVE-2025-29824 Detail - NVD NVD (NIST) · Advisory · 2025-04-08
• My "Blind Date" with CVE-2025-29824 starlabs.sg · Research · 2025-07-16
• Exploitation of CLFS zero-day leads to ransomware activity Microsoft · Vendor report · 2025-04-08
• Dissecting PipeMagic: Inside the architecture of a modular backdoor framework Microsoft · Vendor report · 2025-08-18
• CVE-2025-29824 - Security Update Guide - Microsoft Microsoft Security Response Center · Vendor report · 2025-04-08
• Ransomware Attackers Leveraged Privilege Escalation Zero-day security.com · Research · 2025-04-22
• Deep dive into CVE-2025-29824 in Windows bi.zone · Research · 2025-05-01
• From Exploit to Ransomware: Detecting CVE-2025-29824 logpoint.com · Blog · 2025-04-10
• PipeMagic Casts a Spell on Windows CLFS to Deploy Ransomware fortifiedhealthsecurity.com · Blog · 2025-04-15
• PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware The Hacker News · News · 2025-04-09
• Windows CLFS zero-day exploited in ransomware attacks cybersecuritydive.com · News · 2025-04-09
• Microsoft: Windows CLFS Vulnerability Could Lead to 'Widespread Deployment and Detonation of Ransomware' techrepublic.com · News · 2025-04-09

Threats related to Storm-2460 CLFS PipeMagic chain

• Windows Defender 0-Day Local Privilege Escalation "RoguePlanet" (Nightmare Eclipse Defender Exploit Series)
• The Gentlemen Ransomware (RaaS) — Defense Evasion TTPs: Event Log Clearing, Defender Disable & AV Exclusions via PowerShell + Scheduled Tasks (Huntress April/May 2026 IRs)
• Green Blood v2.0 — Golang-Based Double-Extortion Ransomware Targeting South Asia & Africa

Related coverage of this activity

• Luna Moth vishing physical intrusion
• BREEZE COMET Brazilian financial APT
• FalconFlank CrowdStrike LPE PoC
• khunt Tomcat SQL injection

Previous and next in vulnerability

• CVE-2026-20841: Command Injection in Windows Notepad Markdown Link Handling Enables Arbitrary Code Execution Previous report
• BeyondTrust Pre-Auth RCE (CVE-2026-1731) — CVSS 9.9, CISA KEV, WebSocket Command Injection, VShell/SparkRAT, 16K+ Exposed Instances, Multi-Sector Campaign Next report