Storm-2460 Uses PipeMagic to Deploy Ransomware

Storm-2460 used PipeMagic malware to exploit CVE-2025-29824 in ransomware attacks reported in April 2025, targeting organizations including the Retail sector in the GCC. Exploitation enabled attackers to gain SYSTEM privileges, steal credentials from LSASS memory, and encrypt files. Malware was downloaded from a compromised website, although the initial access method remained unconfirmed.