Storm-2460 PipeMagic exploitation of Windows CLFS

The **Play ransomware** group tracked as **Storm-2460** is actively exploiting **CVE-2025-29824** on unpatched **Windows Common Log File System (CLFS)** systems to gain elevated privileges and deploy ransomware. The intrusion chain starts with a modified **ChatGPT Desktop Application** project that acts as an in-memory dropper, decrypts **PipeMagic**, and launches the backdoor. Once **PipeMagic** is active, the operators use the CLFS flaw to escalate access before pushing the ransomware payload. Observed activity spans organizations in the **IT**, **financial**, and **real estate** sectors across the **US**, **Europe**, **South America**, and the **Middle East**. The newer **PipeMagic** build adds persistence and lateral-movement capability, which helps the operators stay inside victim networks and expand the intrusion. Microsoft patched **CVE-2025-29824** in April 2025, but available evidence does not give a reliable victim count, so the full reach of the campaign remains unknown.