Microsoft researchers have detailed a modular backdoor framework called “PipeMagic,” used by threat actors to stealthily deploy ransomware.
PipeMagic
PipeMagic is a modular Windows backdoor linked to financially motivated ransomware activity attributed by Microsoft to Storm-2460, an actor associated with RansomEXX and also tracked in reporting as the Play ransomware group.
Profile source: Mallory opens in a new tabPipeMagic
Family profile
PipeMagic is a modular Windows backdoor linked to financially motivated ransomware activity attributed by Microsoft to Storm-2460, an actor associated with RansomEXX and also tracked in reporting as the Play ransomware group. First identified during RansomEXX activity in late 2022, it has subsequently been used against organizations in the Middle East and Brazil and in ransomware intrusions affecting organizations in the Americas, Europe, and the Middle East, including IT, financial, real-estate, retail, software, industrial, and manufacturing sectors.
PipeMagic provides persistent remote access and extensible post-compromise control through dynamically delivered modules. It communicates with command-and-control infrastructure over TCP and uses named pipes for local module delivery and inter-module communications. Its in-memory module management supports payload execution, module updates, module removal, self-deletion, process enumeration, and collection and transmission of host details. Observed and recovered plugins add file I/O, payload loading, execution of 64-bit payloads, and .NET payload execution with AMSI bypass. The framework has been deployed in memory and has masqueraded as a modified ChatGPT desktop application to conceal its malicious function.
PipeMagic has been delivered through several mechanisms, including trojanized software, fake ChatGPT-themed applications, malicious Microsoft Help Index content, MSBuild abuse, and DLL side-loading or hijacking involving a legitimate application component. It has also been deployed after exploitation of SAP NetWeaver vulnerabilities. Storm-2460 has used PipeMagic in attacks exploiting CVE-2025-29824, a Windows CLFS elevation-of-privilege vulnerability, to obtain SYSTEM-level access before ransomware deployment. Associated intrusions have included LSASS credential dumping with renamed ProcDump, anti-forensic activity, persistence, lateral movement, and ransomware execution.
Capabilities
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Lateral Movement
- Persistence
- Post Exploitation
- Privilege Escalation
- Reconnaissance
Reported operators
Threat actors
3 named in public reportingMicrosoft published a lengthy analysis of PipeMagic — a backdoor used by a threat actor they call Storm-2460... Once PipeMagic is running, the threat actor performs the CLFS exploit to escalate privileges before launching their ransomware.
"BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan"
Exploited software
Vulnerabilities linked to PipeMagic
5 CVEs CVE-2025-24983 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability CVE-2025-29824 Use-After-Free Privilege Escalation in Windows Common Log File System Driver CVE-2017-0144 EternalBlue SMBv1 Remote Code Execution in Microsoft Windows CVE-2025-31324 Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-42999 Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader
MITRE ATT&CK
PipeMagic in ATT&CK
27 distinct techniquesTechniques
27 techniques T1068 Exploitation for Privilege Escalation T1003 OS Credential Dumping T1003.001 LSASS Memory T1486 Data Encrypted for Impact T1140 Deobfuscate/Decode Files or Information T1570 Lateral Tool Transfer T1127.001 MSBuild T1106 Native API T1566.002 Spearphishing Link T1105 Ingress Tool Transfer T1036 Masquerading T1070.004 File Deletion T1055 Process Injection T1071 Application Layer Protocol T1562.001 Disable or Modify Tools T1210 Exploitation of Remote Services T1620 Reflective Code Loading T1574.001 DLL T1027 Obfuscated Files or Information T1559 Inter-Process Communication T1082 System Information Discovery T1505.003 Web Shell T1559.002 Dynamic Data Exchange T1057 Process Discovery T1041 Exfiltration Over C2 Channel T1190 Exploit Public-Facing Application T1070 Indicator Removal
