Loading malware…
PipeMagic is a modular Windows backdoor linked to financially motivated ransomware activity attributed by Microsoft to Storm-2460, an actor associated with RansomEXX and also tracked in reporting as the Play ransomware group. First identified during RansomEXX activity in late 2022, it has subsequently been used against organizations in the Middle East and Brazil and in ransomware intrusions affecting organizations in the Americas, Europe, and the Middle East, including IT, financial, real-estate, retail, software, industrial, and manufacturing sectors.
PipeMagic provides persistent remote access and extensible post-compromise control through dynamically delivered modules. It communicates with command-and-control infrastructure over TCP and uses named pipes for local module delivery and inter-module communications. Its in-memory module management supports payload execution, module updates, module removal, self-deletion, process enumeration, and collection and transmission of host details. Observed and recovered plugins add file I/O, payload loading, execution of 64-bit payloads, and .NET payload execution with AMSI bypass. The framework has been deployed in memory and has masqueraded as a modified ChatGPT desktop application to conceal its malicious function.
PipeMagic has been delivered through several mechanisms, including trojanized software, fake ChatGPT-themed applications, malicious Microsoft Help Index content, MSBuild abuse, and DLL side-loading or hijacking involving a legitimate application component. It has also been deployed after exploitation of SAP NetWeaver vulnerabilities. Storm-2460 has used PipeMagic in attacks exploiting CVE-2025-29824, a Windows CLFS elevation-of-privilege vulnerability, to obtain SYSTEM-level access before ransomware deployment. Associated intrusions have included LSASS credential dumping with renamed ProcDump, anti-forensic activity, persistence, lateral movement, and ransomware execution.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-24983 (CVSS skóre 7,0) Použitie odalokovaného miesta v pamäti v rámci Windows Win32 Kernel Subsystem by lokálny autentifikovaný útočník mohol zneužiť na eskaláciu privilégií na úroveň oprávnení SYSTEM. Pozn.: Podľa spoločnosti ESET je predmetná zraniteľnosť aktívne zneužívaná útočníkmi na šírenie malvéru PIPEMAGIC minimálne od marca 2023. | Podľa spoločnosti ESET je predmetná zraniteľnosť aktívne zneužívaná útočníkmi na šírenie malvéru PIPEMAGIC minimálne od marca 2023.
Critical Vulnerability in Windows Common Log File System (CLFS) CVE-2025-29824... Use after free in Windows Common Log File System Driver (CLFS) allows an authorised attacker to elevate privileges locally. Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware. | Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware.
The exploit for this vulnerability was executed by the PipeMagic malware, which we first discovered in December 2022 in a RansomExx ransomware campaign.
Ransomware groups and Chinese advanced persistent threat (APT) groups are targeting a critical vulnerability in SAP NetWeaver... The vulnerability, tracked as CVE-2025-31324, has a CVSS score of 10 and affects NetWeaver's Visual Composer development server. Threat actors can exploit the vulnerability using remote attacks to execute arbitrary code without authentication... SAP later confirmed it as an unrestricted file upload vulnerability... allowing attackers to upload malicious files directly to the system without authorization.
RansomEXX, also tracked as Storm-2460, is known for using the modular backdoor named PipeMagic. ReliaQuest observed the deployment of a PipeMagic sample beaconing to a known RansomEXX domain.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft researchers have detailed a modular backdoor framework called “PipeMagic,” used by threat actors to stealthily deploy ransomware.
Microsoft published a lengthy analysis of PipeMagic — a backdoor used by a threat actor they call Storm-2460... Once PipeMagic is running, the threat actor performs the CLFS exploit to escalate privileges before launching their ransomware.
"BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan"
27 distinct techniques documented for this family, organized by ATT&CK tactic.
After decryption, the resulting shellcode is executed via the WinAPI function EnumDeviceMonitor... with the shellcode dynamically resolving their addresses via GetProcAddress.
An example of executing this payload: c:\windows\system32\cmd.exe "/k c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe c:\windows\help\metafile.mshi"
To hinder analysis, the attackers hashed API functions using the FNV-1a algorithm... the loader contains obfuscated C# code and a very long hexadecimal string.
the attackers used a fake ChatGPT client application as bait... However, it had no user functionality – when launched, it simply displayed a blank screen.
This module, found in one of the infections, is responsible for injecting additional payloads into memory and executing them.
The library deploys the decrypted code into memory and transfers control to it, and the original file is subsequently deleted.
An example of executing this payload: c:\windows\system32\cmd.exe "/k c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe c:\windows\help\metafile.mshi"
the application extracted a 105,615-byte AES-encrypted array from its code, decrypted it, and executed it... The C# code serves two purposes – decrypting and executing the shellcode... the file contents are decrypted using the symmetric AES cipher in CBC mode
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a comparison relating to suspicious named-pipe communications.
Mentioned only as part of a related cleanup guide, not as part of the GigaWiper incident itself.
PipeMagic is a backdoor that provides remote access, can operate as a network gateway, supports plugin-based payload delivery and execution, uses named pipes and localhost communication for encrypted payload transfer, and has been observed using multiple loaders including trojanized Rufus, fake ChatGPT applications, .mshi/msbuild execution, and DLL hijacking.
Malware used in intrusion chain for RansomExx ransomware; deployed after exploiting a Windows CLFS privilege escalation flaw (CVE-2025-29824).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.