Exploitation of CLFS zero-day leads to ransomware activity

🗓️ 08 Apr 2025 18:00:00Reported by Microsoft Threat IntelligenceType

Zero-day exploit of CLFS leads to ransomware by Storm-2460 using PipeMagic malware on various sectors.

Reporter	Title	Published	Views	Family All 125
GithubExploit	Exploit for Use After Free in Microsoft	14 May 202501:45	–	githubexploit
GithubExploit	Exploit for Use After Free in Microsoft	27 Oct 202509:46	–	githubexploit
GithubExploit	Exploit for Use After Free in Microsoft	30 Jul 202508:04	–	githubexploit
ATTACKERKB	CVE-2025-29814	21 Mar 202501:15	–	attackerkb
ATTACKERKB	CVE-2025-29824	8 Apr 202500:00	–	attackerkb
ATTACKERKB	CVE-2025-24983	11 Mar 202500:00	–	attackerkb
Information Security Automation	About Elevation of Privilege – Windows Common Log File System Driver (CVE-2025-29824) vulnerability	10 May 202514:43	–	avleonov
Information Security Automation	May “In the Trend of VM” (#15): vulnerabilities in Microsoft Windows and the Erlang/OTP framework	21 May 202513:22	–	avleonov
Information Security Automation	About Elevation of Privilege – Windows Common Log File System Driver (CVE-2025-32701, CVE-2025-32706) vulnerabilities	10 Jun 202512:14	–	avleonov
Information Security Automation	April Microsoft Patch Tuesday	10 Apr 202522:59	–	avleonov

08 Apr 2025 18:00Current

8.1High risk

Vulners AI Score8.1

CVSS 3.19.3

EPSS0.13475

SSVC