# CVE-2025-29824: Windows CLFS Use-After-Free Privilege Escalation Chained with Cisco ASA Compromise and PipeMagic/Storm-2460 Ransomware Attacks

> CVE-2025-29824 is a use-after-free (CWE-416) vulnerability in the Windows Common Log File System (CLFS) driver, caused by premature release of the FsContext2 (CClfsLogCcb) structure in CClfsRequest::Cleanup(), that Microsoft patched on April 8, 2025. It was exploited as a zero-day by the financially motivated group Storm-2460 using the PipeMagic modular backdoor to deploy RansomEXX ransomware, and separately by Balloonfly (Play ransomware operators) in an intrusion that began with a compromised public-facing Cisco ASA firewall.

- **Published:** 2026-02-20T00:00:00Z
- **Last reviewed:** 2026-09-10T00:34:14.649Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1543
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-storm-2460-clfs-pipemagic-chain-tl-2026-1543.webp?v=da6161a5 (Threadlinqs threat intel: CVE-2025-29824 Storm-2460 Windows CLFS: Detection & IOCs (TL-2026-1543) — High severity, 31 IOCs, 9 detection rules.)
- **ID:** TL-2026-1543
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Actor:** Storm-2460
- **Detections:** 9 (1 shown free below) · **IOCs:** 31 (3 shown free below)
- **CVEs:** CVE-2025-29824, CVE-2025-24983

## Description

CVE-2025-29824 is a local privilege-escalation vulnerability in clfs.sys, the kernel-mode driver implementing the Windows Common Log File System. The root cause is a race condition in reference-count handling of the 0x110-byte CClfsLogCcb structure (referenced as FsContext2 by the I/O manager): when a log file handle is closed, CClfsRequest::Cleanup() called CClfsLogCcb::Release(FsContext2) prematurely, while other in-flight IRPs dispatched through DeviceIoControl() (ReserveAndAppendLog — IOCTL 0x8007A827, WriteRestart — IOCTL 0x8007281F, ReadArchiveMetadata — IOCTL 0x80076856) could still reference the same structure. An attacker who opens a CLFS log handle, spawns two threads, and races a targeted DeviceIoControl() call against a concurrent CloseHandle() can force one thread to dereference freed pool memory, yielding a controlled use-after-free that is escalated into arbitrary kernel memory corruption and ultimately a token-privilege overwrite (RtlSetAllBits used to set the token's enabled/present privilege bitmask to 0xFFFFFFFF, i.e. full SYSTEM privileges). Microsoft's fix relocated the Release(FsContext2) call from Cleanup() to Close(), ensuring no active request can reference the structure during deallocation (clfs.sys pre-patch build 10.0.22621.5097, post-patch build 10.0.22621.5192). The bug affects Windows 10, Windows 11 (up to and tested on 23H2; ineffective against 24H2 which additionally requires SeDebugPrivilege), and Windows Server 2008 through 2025.

The vulnerability was exploited in the wild before patch availability. Microsoft attributed a ransomware campaign to Storm-2460, a financially motivated actor that used the PipeMagic modular backdoor (first documented by Kaspersky in October 2024, distributed via a trojanized open-source ChatGPT Desktop Application project on GitHub) for pre-exploitation staging. Storm-2460 abused certutil.exe to download an encrypted payload disguised as a malicious MSBuild project file hosted on a previously compromised, legitimate third-party website; execution decrypted the embedded payload via an EnumCalendarInfoA API callback trick, ultimately loading PipeMagic in memory. PipeMagic then launched an in-memory CVE-2025-29824 exploit from dllhost.exe, using NtQuerySystemInformation for kernel address disclosure and creating a CLFS BLF artifact at C:\ProgramData\SkyPDF\PDUDrv.blf during exploitation. Post-exploitation, the actor injected code into winlogon.exe, used a renamed/repurposed Sysinternals procdump.exe (`dllhost.exe -accepteula -r -ma lsass.exe c:\programdata\[random].dmp`) to dump LSASS memory for credential theft, performed defense evasion (disabling recovery via bcdedit, deleting the Windows backup catalog via wbadmin, clearing the Application event log via wevtutil), and deployed RansomEXX ransomware (launched via `dllhost.exe --do [path]`, dropping a ransom note named `!_READ_ME_REXX2_!.txt` and referencing RansomEXX-linked .onion payment sites). PipeMagic's C2 infrastructure used the Azure-hosted domain aaaaabbbbbbb.eastus.cloudapp.azure[.]com (subsequently disabled) and communicated over a WebSocket-style HTTP channel with spoofed browser headers. Internally PipeMagic organizes payload/execute/network/auxiliary doubly linked lists of RC4-encrypted (32-byte hardcoded keys), aPLib-compressed, SHA-1-validated PE modules exchanged over a named pipe of the form \\.\pipe\1.<Bot_ID_hex>. ESET research has linked PipeMagic activity to exploitation of a related Win32k vulnerability, CVE-2025-24983.

Separately, Symantec/Broadcom (Security.com) reported that Balloonfly — the threat actor operating the Play ransomware-as-a-service operation — deployed the CVE-2025-29824 exploit prior to public disclosure in an intrusion against a U.S. organization where the likely initial-access vector was a public-facing, compromised Cisco ASA firewall appliance. In that intrusion no ransomware payload was ultimately deployed, but the actor dropped the Grixba infostealer (a custom reconnaissance/credential-harvesting tool associated with Balloonfly/Play) alongside assorted hacktools and the local privilege-escalation exploit, illustrating the broader pattern of Cisco ASA edge-device compromise for initial access followed by CVE-2025-29824 for privilege escalation ahead of ransomware detonation. Microsoft has stated the vulnerability carries meaningful risk of widespread ransomware deployment and detonation given its role as a reliable, patch-gap privilege-escalation primitive usable by multiple independent ransomware affiliates.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1203 Exploitation for Client Execution
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1082 System Information Discovery
- T1057 Process Discovery
- T1087 Account Discovery
- T1016 System Network Configuration Discovery
- T1005 Data from Local System
- T1573 Encrypted Channel
- T1571 Non-Standard Port
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1486 Data Encrypted for Impact
- T1490 Inhibit System Recovery
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1136.001 Create Account: Local Account
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1112 Modify Registry
- T1548.002 Abuse Elevation Control Mechanism: Bypass User Account Control
- T1036.005 Masquerading: Match Legitimate Name or Location
- T1070.001 Indicator Removal: Clear Windows Event Logs
- T1003.001 OS Credential Dumping: LSASS Memory
- T1003.002 OS Credential Dumping: Security Account Manager
- T1087.002 Account Discovery: Domain Account
- T1071.001 Application Layer Protocol: Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Renamed ProcDump LSASS Access via dllhost.exe with Anti-Recovery Command Burst** (`TL-2026-1543-SPL-002`)

Detects the post-exploitation phase of the Storm-2460/PipeMagic chain: a renamed/repurposed Sysinternals procdump.exe masquerading as dllhost.exe dumping LSASS memory for credential theft, combined with the rapid-succession anti-recovery command burst (bcdedit/wbadmin/wevtutil) that precedes RansomEXX detonation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1003.001, T1490, T1070.001, T1036.003
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\dllhost.exe" CommandLine="*-accepteula*" CommandLine="*-ma*" CommandLine="*lsass.exe*")
OR (Image="*\\bcdedit.exe" CommandLine="*recoveryenabled no*")
OR (Image="*\\wbadmin.exe" CommandLine="*delete catalog*")
OR (Image="*\\wevtutil.exe" CommandLine="*cl *")
| eval technique=case(match(CommandLine,"lsass"),"T1003.001",match(Image,"bcdedit"),"T1490",match(Image,"wbadmin"),"T1490",match(Image,"wevtutil"),"T1070.001")
| stats count values(technique) as techniques values(CommandLine) as commands earliest(_time) as first_seen latest(_time) as last_seen by Computer, User
| where count >= 1
```

### Microsoft KQL

```kql
let lookback = 24h;
DeviceProcessEvents
| where Timestamp > ago(lookback)
| where (FileName =~ "dllhost.exe" and ProcessCommandLine has "-accepteula" and ProcessCommandLine has "-ma" and ProcessCommandLine has "lsass")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has "recoveryenabled no")
   or (FileName =~ "wbadmin.exe" and ProcessCommandLine has "delete catalog")
   or (FileName =~ "wevtutil.exe" and ProcessCommandLine has "cl ")
| extend MitreTechnique = case(ProcessCommandLine has "lsass", "T1003.001", FileName =~ "bcdedit.exe", "T1490", FileName =~ "wbadmin.exe", "T1490", "T1070.001")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, MitreTechnique
| sort by Timestamp asc
```

### Sigma

```yaml
title: Renamed ProcDump Targeting LSASS via dllhost.exe (Storm-2460/PipeMagic Pattern)
id: 8f2a1c40-1543-4b1e-9f00-tlintel1543a
status: experimental
description: Detects a renamed/repurposed Sysinternals procdump.exe invoked as dllhost.exe to dump LSASS process memory, matching the Storm-2460/PipeMagic post-CVE-2025-29824 credential-theft pattern
references:
    - https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-19
tags:
    - attack.credential-access
    - attack.t1003.001
    - attack.impact
    - attack.t1490
    - attack.defense-evasion
    - attack.t1070.001
    - attack.tool.procdump
    - cve.2025.29824
logsource:
    category: process_creation
    product: windows
detection:
    selection_image:
        Image|endswith: '\dllhost.exe'
    selection_cmdline:
        CommandLine|contains|all:
            - '-accepteula'
            - '-ma'
            - 'lsass.exe'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains: 'recoveryenabled no'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete catalog'
    selection_wevtutil:
        Image|endswith: '\wevtutil.exe'
        CommandLine|contains: 'cl '
    condition: (selection_image and selection_cmdline) or 1 of selection_bcdedit or selection_wbadmin or selection_wevtutil
falsepositives:
    - Legitimate COM Surrogate activity is extremely unlikely to include ProcDump-style flags
    - Legitimate backup/log-management maintenance scripts (rare in combination within a short window)
level: critical
```

**Known false positives:**

- Legitimate IT-administered backup/log-rotation maintenance scripts running bcdedit/wbadmin/wevtutil in combination; authorized incident-response memory captures using renamed tooling under change control

**Tuning notes:** Correlate the LSASS-access marker and the anti-recovery command burst within a 10-minute window per host to raise confidence to critical; allowlist known backup-job service accounts that legitimately run wbadmin/wevtutil on a schedule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Cisco ASA Edge-Device Compromise Followed by Windows CLFS Exploitation Chain (locked: unlock with TL Creds)
- Process Injection into winlogon.exe/dllhost.exe with Subsequent Reconnaissance Burst (locked: unlock with TL Creds)
- RansomEXX Detonation via dllhost.exe Payload Launcher with Ransom-Note Drop (locked: unlock with TL Creds)
- Renamed ProcDump Targeting LSASS via dllhost.exe (Storm-2460/PipeMagic Pattern) (locked: unlock with TL Creds)
- Anti-Recovery Command Sequence Preceding Ransomware Detonation (locked: unlock with TL Creds)
- PipeMagic WebSocket-Style HTTP Beacon to Azure Cloud App Service C2 (locked: unlock with TL Creds)
- CVE-2025-29824 Exploitation Chain — LOLBin Staging and Anomalous CLFS BLF Artifact (locked: unlock with TL Creds)
- PipeMagic Named-Pipe C2 Naming Convention and Azure Cloud App C2 Egress (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 31)

Defanged, TLP:CLEAR.

- Domain: `aaaaabbbbbbb[.]eastus[.]cloudapp[.]azure[.]com`
- File hash: `6030c4381b8b5d5c5734341292316723a89f1bdbd2d10bb67c4d06b1242afd05`
- File hash: `858efe4f9037e5efebadaaa70aa8ad096f7244c4c4aeade72c51ddad23d05bfe`

Full set of 31 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [My "Blind Date" with CVE-2025-29824](https://starlabs.sg/blog/2025/07-my-blind-date-with-cve-2025-29824/)
- [Exploitation of CLFS zero-day leads to ransomware activity](https://www.microsoft.com/en-us/security/blog/2025/04/08/exploitation-of-clfs-zero-day-leads-to-ransomware-activity/)
- [Dissecting PipeMagic: Inside the architecture of a modular backdoor framework](https://www.microsoft.com/en-us/security/blog/2025/08/18/dissecting-pipemagic-inside-the-architecture-of-a-modular-backdoor-framework/)
- [CVE-2025-29824 - Security Update Guide - Microsoft](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29824)
- [CVE-2025-29824 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-29824)
- [PipeMagic Trojan Exploits Windows Zero-Day Vulnerability to Deploy Ransomware](https://thehackernews.com/2025/04/pipemagic-trojan-exploits-windows-clfs.html)
- [From Exploit to Ransomware: Detecting CVE-2025-29824](https://logpoint.com/en/blog/emerging-threats/from-exploit-to-ransomware-detecting-cve-2025-29824)
- [PipeMagic Casts a Spell on Windows CLFS to Deploy Ransomware](https://fortifiedhealthsecurity.com/threat-bulletin/pipemagic-ransomware/)
- [Ransomware Attackers Leveraged Privilege Escalation Zero-day](https://www.security.com/threat-intelligence/play-ransomware-zero-day)
- [Windows CLFS zero-day exploited in ransomware attacks](https://www.cybersecuritydive.com/news/windows-clfs-zero-day-exploited-ransomware/744878/)
- [Microsoft: Windows CLFS Vulnerability Could Lead to 'Widespread Deployment and Detonation of Ransomware'](https://www.techrepublic.com/article/news-microsoft-windows-common-log-file-system-vulnerability/)
- [Deep dive into CVE-2025-29824 in Windows](https://bi.zone/eng/expertise/blog/podrobnyy-razbor-uyazvimosti-cve-2025-29824-v-os-windows/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1543