Dissecting PipeMagic: Inside the architecture of a modular backdoor framework

🗓️ 18 Aug 2025 15:00:00Reported by Microsoft Threat IntelligenceType

mssecure

mssecure🔗 www.microsoft.com👁 9 Views

PipeMagic: backdoor with dynamic payloads and C2; Storm-2460 exploits CLFS flaw for ransomware.

Reporter	Title	Published	Views	Family All 68
GithubExploit	Exploit for Use After Free in Microsoft	14 May 202501:45	–	githubexploit
GithubExploit	Exploit for Use After Free in Microsoft	27 Oct 202509:46	–	githubexploit
GithubExploit	Exploit for Use After Free in Microsoft	30 Jul 202508:04	–	githubexploit
ATTACKERKB	CVE-2025-29824	8 Apr 202500:00	–	attackerkb
Information Security Automation	About Elevation of Privilege – Windows Common Log File System Driver (CVE-2025-29824) vulnerability	10 May 202514:43	–	avleonov
Information Security Automation	May “In the Trend of VM” (#15): vulnerabilities in Microsoft Windows and the Erlang/OTP framework	21 May 202513:22	–	avleonov
Information Security Automation	About Elevation of Privilege – Windows Common Log File System Driver (CVE-2025-32701, CVE-2025-32706) vulnerabilities	10 Jun 202512:14	–	avleonov
Information Security Automation	April Microsoft Patch Tuesday	10 Apr 202522:59	–	avleonov
BDU FSTEC	The vulnerability of the Windows Common Log File System (CLFS) driver in Windows operating systems allows a hacker to elevate their privileges to a system-level level.	9 Apr 202500:00	–	bdu_fstec
Circl	CVE-2025-29824	8 Apr 202516:14	–	circl

18 Aug 2025 15:00Current

9.3High risk

Vulners AI Score9.3

CVSS 3.17.8

EPSS0.1806

modular backdoor dynamic payloads command and control storm-2460 ransomware deployment target sectors