Skip to main content
عربي
logo

NCSC-TAD-2504-001

Severity Level: Critical
Ransomware

Reference No.: NCSC-TAD-2504-001CVSS 0

Storm-2460 Uses PipeMagic to Deploy Ransomware

Threat Type:
N/A
TLP:
CLEAR
CVE:
N/A

Overview

Storm-2460 used PipeMagic malware to exploit CVE-2025-29824 in ransomware attacks reported in April 2025, targeting organizations including the Retail sector in the GCC. Exploitation enabled attackers to gain SYSTEM privileges, steal credentials from LSASS memory, and encrypt files. Malware was downloaded from a compromised website, although the initial access method remained unconfirmed.

Affected Technologies

  • Windows Common Log File System (CLFS)

Mitigation and Immediate Actions

  1. 01

    Apply the latest security updates to address CVE-2025-29824.

References