Microsoft researchers have detailed a modular backdoor framework called “PipeMagic,” used by threat actors to stealthily deploy ransomware.
PipeMagic
PipeMagic is a modular Windows backdoor associated with financially motivated ransomware activity, most notably operations linked to Storm-2460 and the RansomExx ecosystem.
Profile source: Mallory opens in a new tabPipeMagic
Family profile
PipeMagic is a modular Windows backdoor associated with financially motivated ransomware activity, most notably operations linked to Storm-2460 and the RansomExx ecosystem. First observed in 2022, it has remained active through later campaigns in the Middle East and Brazil and has been used as a staging and persistence framework before ransomware deployment. PipeMagic has also been reported in intrusions involving exploitation of SAP NetWeaver and Windows privilege-escalation vulnerabilities, including CVE-2025-29824.
The malware is designed to provide persistent remote access and flexible post-compromise control through a plugin-based architecture. It is commonly deployed in memory and uses named pipes together with a localhost communication mechanism to pass modules and payloads internally. PipeMagic can establish command-and-control communications over TCP, collect host and user information, receive and manage additional modules in memory, execute commands, enumerate processes, delete modules, and remove itself. Reported plugins extend functionality with file I/O handling, payload loading, and .NET execution, including AMSI bypass to facilitate in-memory execution of follow-on payloads.
Observed delivery methods include trojanized software, a fake ChatGPT desktop application used as a lure, malicious help-file based loaders, DLL hijacking, MSBuild abuse, and deployment through web shells after server-side exploitation. Earlier activity also involved exploitation of CVE-2017-0144 for initial access. In ransomware intrusions, operators have used PipeMagic before exploiting local privilege-escalation flaws to obtain SYSTEM privileges and then deploy ransomware. Associated post-exploitation activity has included credential theft via LSASS dumping and actions supporting lateral movement.
Victims have included industrial, IT, financial, real estate, retail, manufacturing, and enterprise environments across Southeast Asia, the Middle East, South America, Europe, and the United States. PipeMagic is notable for its stealth-oriented modular design, in-memory operation, and role as an extensible access platform that supports ransomware operators through persistence, payload delivery, privilege escalation workflows, credential access, and broader post-compromise control.
Capabilities
- Credential Theft
- Defense Evasion
- Dll Sideloading
- Exfiltration
- Lateral Movement
- Persistence
- Post Exploitation
- Privilege Escalation
Reported operators
Threat actors
3 named in public reportingMicrosoft published a lengthy analysis of PipeMagic — a backdoor used by a threat actor they call Storm-2460... Once PipeMagic is running, the threat actor performs the CLFS exploit to escalate privileges before launching their ransomware.
"BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan"
Exploited software
Vulnerabilities linked to PipeMagic
4 CVEs CVE-2017-0144 EternalBlue SMBv1 Remote Code Execution CVE-2025-29824 Windows CLFS Driver Use-After-Free Local Privilege Escalation CVE-2025-31324 Unauthenticated Arbitrary File Upload in SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-42999 Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader
MITRE ATT&CK
PipeMagic in ATT&CK
25 distinct techniquesTechniques
25 techniques T1140 Deobfuscate/Decode Files or Information T1570 Lateral Tool Transfer T1127.001 MSBuild T1106 Native API T1566.002 Spearphishing Link T1105 Ingress Tool Transfer T1036 Masquerading T1070.004 File Deletion T1068 Exploitation for Privilege Escalation T1055 Process Injection T1071 Application Layer Protocol T1562.001 Disable or Modify Tools T1210 Exploitation of Remote Services T1620 Reflective Code Loading T1574.001 DLL T1027 Obfuscated Files or Information T1559 Inter-Process Communication T1003.001 LSASS Memory T1082 System Information Discovery T1505.003 Web Shell T1559.002 Dynamic Data Exchange T1057 Process Discovery T1041 Exfiltration Over C2 Channel T1190 Exploit Public-Facing Application T1070 Indicator Removal
