CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks

CVE-2025-29824 (TL-2026-1543), also tracked as CLFS Zero-Day Ransomware Campaign, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-02-20 and last reviewed 2026-09-10. It is attributed to Storm-2460 with medium confidence, affects Microsoft Windows CLFS Driver (clfs.sys), references 2 CVEs (CVE-2025-29824, CVE-2025-24983), maps to 37 MITRE ATT&CK techniques (T1003, T1003.001, T1003.002), and is covered by 9 detection rules and 31 indicators of compromise.

Key facts for TL-2026-1543

Threat ID
TL-2026-1543
Also known as
CLFS Zero-Day Ransomware Campaign
Severity
HIGH
CVSS
7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-02-20
Last reviewed
2026-09-10
Attribution
Storm-2460
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Target sectors
information technology, real estate, financial services, software development, retail
Target regions
united states of america, venezuela, spain, saudi arabia
Detection rules
9
Indicators of compromise
31
Updates
2026-09-10 · revalidated 1× · latest source

Malware and tooling in CVE-2025-29824

Malware and tooling: Grixba, PipeMagic, RansomEXX, certutil - S0160, procdump.exe

CVE-2025-29824 is a use-after-free (CWE-416) vulnerability in the Windows Common Log File System (CLFS) driver, caused by premature release of the FsContext2 (CClfsLogCcb) structure in CClfsRequest::Cleanup(), that Microsoft patched on April 8, 2025. It was exploited as a zero-day by the financially motivated group Storm-2460 using the PipeMagic modular backdoor to deploy RansomEXX ransomware, and separately by Balloonfly (Play ransomware operators) in an intrusion that began with a compromised public-facing Cisco ASA firewall.

How CVE-2025-29824 works

CVE-2025-29824 is a local privilege-escalation vulnerability in clfs.sys, the kernel-mode driver implementing the Windows Common Log File System. The root cause is a race condition in reference-count handling of the 0x110-byte CClfsLogCcb structure (referenced as FsContext2 by the I/O manager): when a log file handle is closed, CClfsRequest::Cleanup() called CClfsLogCcb::Release(FsContext2) prematurely, while other in-flight IRPs dispatched through DeviceIoControl() (ReserveAndAppendLog — IOCTL 0x8007A827, WriteRestart — IOCTL 0x8007281F, ReadArchiveMetadata — IOCTL 0x80076856) could still reference the same structure. An attacker who opens a CLFS log handle, spawns two threads, and races a targeted DeviceIoControl() call against a concurrent CloseHandle() can force one thread to dereference freed pool memory, yielding a controlled use-after-free that is escalated into arbitrary kernel memory corruption and ultimately a token-privilege overwrite (RtlSetAllBits used to set the token's enabled/present privilege bitmask to 0xFFFFFFFF, i.e. full SYSTEM privileges). Microsoft's fix relocated the Release(FsContext2) call from Cleanup() to Close(), ensuring no active request can reference the structure during deallocation (clfs.sys pre-patch build 10.0.22621.5097, post-patch build 10.0.22621.5192). The bug affects Windows 10, Windows 11 (up to and tested on 23H2; ineffective against 24H2 which additionally requires SeDebugPrivilege), and Windows Server 2008 through 2025.

The vulnerability was exploited in the wild before patch availability. Microsoft attributed a ransomware campaign to Storm-2460, a financially motivated actor that used the PipeMagic modular backdoor (first documented by Kaspersky in October 2024, distributed via a trojanized open-source ChatGPT Desktop Application project on GitHub) for pre-exploitation staging. Storm-2460 abused certutil.exe to download an encrypted payload disguised as a malicious MSBuild project file hosted on a previously compromised, legitimate third-party website; execution decrypted the embedded payload via an EnumCalendarInfoA API callback trick, ultimately loading PipeMagic in memory. PipeMagic then launched an in-memory CVE-2025-29824 exploit from dllhost.exe, using NtQuerySystemInformation for kernel address disclosure and creating a CLFS BLF artifact at C:\ProgramData\SkyPDF\PDUDrv.blf during exploitation. Post-exploitation, the actor injected code into winlogon.exe, used a renamed/repurposed Sysinternals procdump.exe (`dllhost.exe -accepteula -r -ma lsass.exe c:\programdata\[random].dmp`) to dump LSASS memory for credential theft, performed defense evasion (disabling recovery via bcdedit, deleting the Windows backup catalog via wbadmin, clearing the Application event log via wevtutil), and deployed RansomEXX ransomware (launched via `dllhost.exe --do [path]`, dropping a ransom note named `!_READ_ME_REXX2_!.txt` and referencing RansomEXX-linked .onion payment sites). PipeMagic's C2 infrastructure used the Azure-hosted domain aaaaabbbbbbb.eastus.cloudapp.azure[.]com (subsequently disabled) and communicated over a WebSocket-style HTTP channel with spoofed browser headers. Internally PipeMagic organizes payload/execute/network/auxiliary doubly linked lists of RC4-encrypted (32-byte hardcoded keys), aPLib-compressed, SHA-1-validated PE modules exchanged over a named pipe of the form \\.\pipe\1.<Bot_ID_hex>. ESET research has linked PipeMagic activity to exploitation of a related Win32k vulnerability, CVE-2025-24983.

Separately, Symantec/Broadcom (Security.com) reported that Balloonfly — the threat actor operating the Play ransomware-as-a-service operation — deployed the CVE-2025-29824 exploit prior to public disclosure in an intrusion against a U.S. organization where the likely initial-access vector was a public-facing, compromised Cisco ASA firewall appliance. In that intrusion no ransomware payload was ultimately deployed, but the actor dropped the Grixba infostealer (a custom reconnaissance/credential-harvesting tool associated with Balloonfly/Play) alongside assorted hacktools and the local privilege-escalation exploit, illustrating the broader pattern of Cisco ASA edge-device compromise for initial access followed by CVE-2025-29824 for privilege escalation ahead of ransomware detonation. Microsoft has stated the vulnerability carries meaningful risk of widespread ransomware deployment and detonation given its role as a reliable, patch-gap privilege-escalation primitive usable by multiple independent ransomware affiliates.

MITRE ATT&CK techniques used in TL-2026-1543

Credential Access

T1003 OS Credential Dumping; T1003.001 OS Credential Dumping: LSASS Memory; T1003.002 OS Credential Dumping: Security Account Manager

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1087 Account Discovery; T1087.002 Account Discovery: Domain Account

Defense Evasion

T1036 Masquerading; T1036.005 Masquerading: Match Legitimate Name or Location; T1055 Process Injection; T1070 Indicator Removal; T1070.001 Indicator Removal: Clear Windows Event Logs; T1112 Modify Registry; T1140 Deobfuscate/Decode Files or Information; T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control

Persistence

T1053.005 Scheduled Task/Job: Scheduled Task; T1136.001 Create Account: Local Account; T1547 Boot or Logon Autostart Execution

Execution

T1059 Command and Scripting Interpreter; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.003 Command and Scripting Interpreter: Windows Command Shell; T1203 Exploitation for Client Execution; T1569 System Services

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1134 Access Token Manipulation

Command and Control

T1071 Application Layer Protocol; T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573 Encrypted Channel

Initial Access

T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

Impact

T1486 Data Encrypted for Impact; T1490 Inhibit System Recovery

defense-impairment

T1685 Disable or Modify Tools

Affected products and versions in CVE-2025-29824

  • Microsoft — Windows CLFS Driver (clfs.sys)
    Vulnerable versions: Windows 10; Windows 11 (up to 23H2); Windows Server 2008; Windows Server 2012; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025
    Fixed in: clfs.sys 10.0.22621.5192 and later (Windows 11 23H2); April 8, 2025 cumulative updates for all affected versions
  • Cisco — Adaptive Security Appliance (ASA) / Firepower Threat Defense (FTD)
    Vulnerable versions: Internet-facing ASA/FTD appliances exploited via separate, unpatched vulnerabilities used as initial access in the Balloonfly intrusion
    Fixed in: Refer to Cisco security advisories cisco-sa-asaftd-webvpn-z5xP8EUB and cisco-sa-asaftd-persist-CISAED25-03

Remediation for CVE-2025-29824

Patches

  • Microsoft Windows security update, April 8, 2025 (clfs.sys build 10.0.22621.5192 or later on Windows 11 23H2; equivalent builds for other supported versions)

Immediate actions

  • Apply Microsoft's April 8, 2025 security update for CVE-2025-29824 to all Windows 10, Windows 11, and Windows Server 2008-2025 hosts
  • Patch or isolate internet-facing Cisco ASA firewalls; review Cisco security advisories for the ASA/FTD zero-days used for initial access
  • Hunt for C:\ProgramData\SkyPDF\PDUDrv.blf and other anomalous .blf artifacts outside normal CLFS log paths
  • Hunt for renamed procdump.exe invocations targeting lsass.exe and process injection into winlogon.exe/dllhost.exe
  • Block/monitor egress to aaaaabbbbbbb.eastus.cloudapp.azure[.]com and the associated RansomEXX .onion payment sites

Workarounds

  • Restrict local logon/console access on high-value Windows hosts; monitor and restrict certutil.exe network usage via application control policies

Longer-term hardening

  • Deploy EDR with kernel-mode exploit and LSASS-access behavioral detection
  • Enforce least-privilege on standard user accounts to reduce local privilege-escalation blast radius
  • Implement network segmentation isolating perimeter firewall management planes from internal Windows infrastructure
  • Establish rapid out-of-band patch deployment SLAs for kernel driver elevation-of-privilege advisories tied to active exploitation

CVEs associated with CVE-2025-29824

CVE-2025-29824, CVE-2025-24983

Weaknesses (CWE) in CVE-2025-29824

CWE-416, CWE-362

Timeline of CVE-2025-29824

  • PipeMagic is first used in the wild to deliver a Win32k Kernel Subsystem zero-day exploit (later designated CVE-2025-24983) against Windows 8.1 and Windows Server 2012 R2, roughly two years before the CLFS zero-day activity.
  • Kaspersky publicly documents the PipeMagic modular backdoor for the first time, distributed via a trojanized open-source ChatGPT Desktop Application project on GitHub
  • Microsoft's March 2025 Patch Tuesday fixes CVE-2025-24983 (Win32k Kernel Subsystem use-after-free, CVSS 7.0), the first of two Windows kernel zero-days delivered via PipeMagic; exploited in the wild for roughly two years before the patch.
  • CISA adds CVE-2025-29824 to the Known Exploited Vulnerabilities catalog the same day Microsoft patches it, invoking BOD 22-01 remediation requirements for FCEB agencies.
  • Microsoft releases security updates patching CVE-2025-29824 (clfs.sys build 10.0.22621.5192+ on Windows 11 23H2) and publishes a blog attributing in-the-wild exploitation to Storm-2460 using PipeMagic to deploy ransomware
  • The Hacker News, Cybersecurity Dive, and TechRepublic report on the PipeMagic/CLFS zero-day ransomware campaign, noting Microsoft's warning about risk of widespread ransomware detonation
  • Logpoint publishes detection guidance covering the exploit-to-ransomware chain for CVE-2025-29824
  • Symantec/Broadcom (Security.com) discloses that Balloonfly (Play ransomware operators) deployed the CVE-2025-29824 exploit before public disclosure in a U.S. intrusion that began with a compromised public-facing Cisco ASA firewall, alongside the Grixba infostealer
  • CISA's BOD 22-01 remediation due date for CVE-2025-29824 for U.S. Federal Civilian Executive Branch (FCEB) agencies.
  • BI.ZONE publishes an independent technical deep dive into the CVE-2025-29824 CLFS vulnerability and exploitation mechanics
  • Star Labs publishes "My 'Blind Date' with CVE-2025-29824", a detailed root-cause and exploitation-mechanics writeup covering the FsContext2/CClfsLogCcb use-after-free and the pre/post patch behavior of CClfsRequest::Cleanup()
  • Microsoft Security publishes an in-depth architectural analysis of the PipeMagic backdoor, detailing its plugin/module linked-list system, RC4/aPLib module handling, and named-pipe C2 protocol, and connects related activity to CVE-2025-24983 (Win32k) per ESET research

Update history for TL-2026-1543

Sources cited for CVE-2025-29824

Threats related to CVE-2025-29824

Detection coverage for TL-2026-1543

As of 2026-09-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1543 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats