CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks — Threadlinqs Intelligence
As of 2026-02-20, CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks is a high-severity vulnerability threat attributed to Storm-2460, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-1543 · Severity: HIGH · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: Storm-2460 · FINANCIAL
CVE-2025-29824 is a use-after-free (CWE-416) vulnerability in the Windows Common Log File System (CLFS) driver, caused by premature release of the FsContext2 (CClfsLogCcb) structure in
CVE-2025-29824 is a local privilege-escalation vulnerability in clfs.sys, the kernel-mode driver implementing the Windows Common Log File System. The root cause is a race condition in reference-count handling of the 0x110-byte CClfsLogCcb structure (referenced as FsContext2 by the I/O manager): when a log file handle is closed, CClfsRequest::Cleanup() called CClfsLogCcb::Release(FsContext2) prematurely, while other in-flight IRPs dispatched through DeviceIoControl() (ReserveAndAppendLog — IOCTL 0x8007A827, WriteRestart — IOCTL 0x8007281F, ReadArchiveMetadata — IOCTL 0x80076856) could still reference the same structure. An attacker who opens a CLFS log handle, spawns two threads, and races a targeted DeviceIoControl() call against a concurrent CloseHandle() can force one thread to dereference freed pool memory, yielding a controlled use-after-free that is escalated into arbitrary kernel memory corruption and ultimately a token-privilege overwrite (RtlSetAllBits used to set the token's enabled/present privilege bitmask to 0xFFFFFFFF, i.e. full SYSTEM privileges). Microsoft's fix relocated the Release(FsContext2) call from Cleanup() to Close(), ensuring no active request can reference the structure during deallocation (clfs.sys pre-patch build 10.0.22621.5097, post-patch build 10.0.22621.5192). The bug affects Windows 10, Windows 11 (up to and tested on 23H2; ineffective against 24H2 which additionally requires SeDebugPrivilege), and Windows Server 2008 through 2025.
The vulnerability was exploited in the wild before patch availability. Microsoft attributed a ransomware campaign to Storm-2460, a financially motivated actor that used the PipeMagic modular backdoor (first documented by Kaspersky in October 2024, distributed via a trojanized open-source ChatGPT Desktop Application project on GitHub) for pre-exploitation staging. Storm-2460 abused certutil.exe to download an encrypted payload disguised as a malicious MSBuild project file hosted on a previously compromised, legitimate third-party website; execution decrypted the embedded payload via an EnumCalendarInfoA API callback trick, ultimately loading PipeMagic in memory. PipeMagic then launched an in-memory CVE-2025-29824 exploit from dllhost.exe, using NtQuerySystemInformation for kernel address disclosure and creating a CLFS BLF artifact at C:\ProgramData\SkyPDF\PDUDrv.blf during exploitation. Post-exploitation, the actor injected code into winlogon.exe, used a renamed/repurposed Sysinternals procdump.exe (`dllhost.exe -accepteula -r -ma lsass.exe c:\programdata\[random].dmp`) to dump LSASS memory for credential theft, performed defense evasion (disabling recovery via bcdedit, deleting the Windows backup catalog via wbadmin, clearing the Application event log via wevtutil), and deployed RansomEXX ransomware (launched via `dllhost.exe --do [path]`, dropping a ransom note named `!_READ_ME_REXX2_!.txt` and referencing RansomEXX-linked .onion payment sites). PipeMagic's C2 infrastructure used the Azure-hosted domain aaaaabbbbbbb.eastus.cloudapp.azure[.]com (subsequently disabled) and communicated over a WebSocket-style HTTP channel with spoofed browser headers. Internally PipeMagic organizes payload/execute/network/auxiliary doubly linked lists of RC4-encrypted (32-byte hardcoded keys), aPLib-compressed, SHA-1-validated PE modules exchanged over a named pipe of the form \\.\pipe\1.<Bot_ID_hex>. ESET research has linked PipeMagic activity to exploitation of a related Win32k vulnerability, CVE-2025-24983.
Separately, Symantec/Broadcom (Security.com) reported that Balloonfly — the threat actor operating the Play ransomware-as-a-service operation — deployed the CVE-2025-29824 exploit prior to public disclosure in an intrusion against a U.S. organization where the likely initial-access vector was a public-facing, compromised Cisco ASA firewall appliance. In that intrusion no ransomware payload was ultimately deployed, but the actor dropped the Grixba infostealer (a custom reconnais
Weaknesses (CWE)
CWE-416, CWE-362
Target sectors: information technology, real estate, financial services, software development, retail
Target regions: united states of america, venezuela, spain, saudi arabia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, HIGH, threat intelligence, cybersecurity, CVE-2025-29824, CVE-2025-24983, T1190, T1195, T1203, T1059, T1569, T1547, T1068, T1134, T1055, T1140