Loading malware…
PipeMagic is a modular Windows backdoor associated with financially motivated threat actor Storm-2460 and RansomEXX ransomware operations. First discovered in December 2022 during attacks against industrial companies in Southeast Asia, it subsequently appeared in campaigns affecting the Middle East and Brazil. Observed targets include manufacturing, information technology, financial services, retail, real estate, and software organizations.
PipeMagic provides remote access and command execution and supports a network gateway mode. Its architecture uses named pipes and a local communication interface, with TCP-based command-and-control. It receives additional modules over the network and maintains modules in memory, allowing operators to update and extend its functionality. It collects and exfiltrates basic host information, including computer and user names and system specifications. Recovered plugins provide file input/output, additional payload execution, and .NET payload loading with AMSI bypass. The framework supports persistent access and subsequent ransomware deployment.
Delivery chains have used trojanized software, including Rufus and a counterfeit ChatGPT desktop application derived from an open-source project. Other observed execution methods include obfuscated C# loaders, DLL hijacking through a legitimate Google Chrome updater component, and MSBuild abuse. PipeMagic has also been deployed through web shells following exploitation of SAP NetWeaver vulnerability CVE-2025-31324.
PipeMagic-associated campaigns have exploited Windows privilege-escalation vulnerabilities CVE-2025-24983 and CVE-2025-29824. The latter affects the Windows Common Log File System driver and has been executed through PipeMagic to obtain SYSTEM privileges before ransomware deployment. Operators have also used ProcDump to extract LSASS memory for credential theft and to support lateral movement.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft researchers have detailed a modular backdoor framework called “PipeMagic,” used by threat actors to stealthily deploy ransomware.
Microsoft published a lengthy analysis of PipeMagic — a backdoor used by a threat actor they call Storm-2460... Once PipeMagic is running, the threat actor performs the CLFS exploit to escalate privileges before launching their ransomware.
"BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan"
27 distinct techniques documented for this family, organized by ATT&CK tactic.
"At least two different cybercrime groups BianLian and RansomExx are said to have exploited a recently disclosed security flaw in SAP NetWeaver..."
In October 2024, organizations in the Middle East were hit by a new wave of PipeMagic attacks. This time, rather than exploiting vulnerabilities for the initial penetration, the attackers used a fake ChatGPT client application as bait.
After decryption, the resulting shellcode is executed via the WinAPI function EnumDeviceMonitor... with the shellcode dynamically resolving their addresses via GetProcAddress.
An example of executing this payload: c:\windows\system32\cmd.exe "/k c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe c:\windows\help\metafile.mshi"
One unique feature of PipeMagic is that it generates a random 16-byte array used to create a named pipe... This communication method is necessary for the backdoor to transmit encrypted payloads and notifications.
"...staying hidden through encrypted named pipes..."
the malicious logic was implemented through a library that it loads, using the DLL hijacking method. For this, a malicious DLL was placed on the disk alongside the legitimate application
"The attacks involved the delivery of PipeMagic by means of web shells dropped following the exploitation of the SAP NetWeaver flaw."
This module, found in one of the infections, is responsible for injecting additional payloads into memory and executing them.
Zraniteľnosť v produkte Microsoft Dataverse spočíva v nesprávnej autorizácii a vzdialený autentifikovaný útočník by ju mohol zneužiť na eskaláciu privilégií.
To hinder analysis, the attackers hashed API functions using the FNV-1a algorithm... the loader contains obfuscated C# code and a very long hexadecimal string.
the attackers used a fake ChatGPT client application as bait... However, it had no user functionality – when launched, it simply displayed a blank screen.
This module, found in one of the infections, is responsible for injecting additional payloads into memory and executing them.
"...even rename the backdoor executable for self-deletion."
The library deploys the decrypted code into memory and transfers control to it, and the original file is subsequently deleted.
An example of executing this payload: c:\windows\system32\cmd.exe "/k c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe c:\windows\help\metafile.mshi"
the application extracted a 105,615-byte AES-encrypted array from its code, decrypted it, and executed it... The C# code serves two purposes – decrypting and executing the shellcode... the file contents are decrypted using the symmetric AES cipher in CBC mode
the malicious logic was implemented through a library that it loads, using the DLL hijacking method. For this, a malicious DLL was placed on the disk alongside the legitimate application
Next, memory was allocated, necessary offsets in the import table were relocated, and finally, the backdoor’s entry point was called.
To prevent the payload from being detected by the AMSI interface, the attackers first load a local copy of the amsi library... and patch them... a stub function is placed in memory that always returns 0
Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware.
Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware.
"Storm-2460 can also... enumerate processes..."
When communication with the C2 is first established, the malware collects comprehensive system information and transmits it back to the C2 via the network module.
The victims were industrial companies in Southeast Asia. To penetrate the infrastructure, the attackers exploited the CVE-2017-0144 vulnerability.
Later, having the LSASS process memory dump, attackers can extract credentials from the compromised device and, consequently, attempt various lateral movement vectors within the network.
To download modules... attackers used a domain hosted on the Microsoft Azure cloud provider, with the following name: hxxp://aaaaabbbbbbb.eastus.cloudapp.azure[.]com
To download modules (PipeMagic typically uses several plugins downloaded from the C2 server), attackers used a domain hosted on the Microsoft Azure cloud provider
"...before receiving instructions on what modules to run or which data to exfiltrate."
Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
33 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.