Windows CLFS Flaw Being Actively Exploited by Ransomware Group
Microsoft has patched a vulnerability in the Windows Common Log File System (CLFS) that is being actively exploited by a threat actor tracked as Storm-2460 after first deploying PipeMagic malware. The malware is used to exploit the flaw to elevate privileges to facilitate the widespread deployment of ransomware on victims’ systems.
Windows CLFS is a logging system used for managing transactional records. The vulnerability is tracked as CVE-2025-29824 and is a use-after-free vulnerability affecting the CLFS kernel driver. The vulnerability has been assigned a CVSS base score of 7.8 (high severity), as it cannot be remotely exploited without first compromising a vulnerable system.
PipeMagic malware was first identified in 2022 and provides a backdoor into compromised systems and serves as a gateway. The malware has previously been used to facilitate the exploitation of other vulnerabilities and has been observed being delivered via a fake ChatGPT application, although the initial access vector used in the latest attacks has yet to be determined. Microsoft has observed the threat actor using the certutil utility to download a file with an encrypted PipeMagic payload. The malware was used to exploit the vulnerability in memory from a dllhost.exe process.
Successful exploitation of the flaw allows an authorized attacker to locally elevate privileges to system level to facilitate the next stage of the attack – the deployment of ransomware across the compromised network. The vulnerability affects multiple Windows and Windows Server versions, although customers running Windows 11 version 24H2 appear not to have been targeted, even though the vulnerability exists in that version.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Microsoft reports that the vulnerability has been exploited in limited attacks on customers in the information technology, financial services, and real estate sectors to date by the RansomEXX ransomware group. Customers in other sectors may also be targeted. Since the vulnerability is being actively exploited, Microsoft customers have been advised to prioritize patching the vulnerability along with other elevation of privilege vulnerabilities in its April 2025 Patch Tuesday updates to improve their defenses against ransomware attacks.
