Loading malware…
PipeMagic is a modular Windows backdoor associated with financially motivated ransomware activity, particularly operations linked to Storm-2460 and the RansomExx ecosystem, and also observed in intrusions involving Play and BianLian-linked activity. First observed in late 2022, it has been used to establish persistent remote access, execute commands, collect host information, and extend functionality through dynamically delivered modules. Its architecture supports in-memory deployment and self-updating behavior, with modules managed internally to provide flexible post-compromise control while complicating detection and analysis.
PipeMagic has been delivered through multiple intrusion paths. Observed delivery methods include exploitation of Windows privilege-escalation vulnerabilities such as CVE-2025-29824 and CVE-2025-24983, fake ChatGPT-themed applications, malicious Microsoft Help files, DLL sideloading or hijacking chains involving legitimate software components, abuse of MSBuild, and deployment after exploitation of SAP NetWeaver flaws via webshell access. Earlier activity also tied PipeMagic deployment to exploitation of CVE-2017-0144. Across campaigns, operators used PipeMagic as a post-exploitation framework to maintain access and prepare ransomware execution.
The malware functions as a remote-access backdoor and modular framework. Reported capabilities include command execution, process enumeration, module loading and deletion, self-deletion, recollection and exfiltration of system information, and support for additional plugins. Documented plugins expanded functionality for file I/O, payload loading, and .NET execution, including AMSI bypass to facilitate in-memory execution of follow-on payloads. PipeMagic has also been described as supporting a network gateway mode in addition to its backdoor role.
PipeMagic activity has been closely associated with privilege escalation, credential theft, lateral movement, and ransomware staging. In observed campaigns, operators used it alongside LSASS dumping with renamed ProcDump to obtain credentials and move laterally before deploying ransomware. Microsoft and other researchers linked PipeMagic-enabled intrusions to attacks against organizations in the United States, Europe, South America, the Middle East, Southeast Asia, and Brazil, including victims in industrial, IT, financial, real estate, retail, manufacturing, and enterprise SAP environments.
PipeMagic is notable for combining stealthy in-memory modularity with flexible delivery chains and close integration into ransomware operations. Its repeated use across multiple campaigns and exploit paths indicates it serves as a reusable post-compromise access platform for high-impact financially motivated intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2025-24983 (CVSS skóre 7,0) Použitie odalokovaného miesta v pamäti v rámci Windows Win32 Kernel Subsystem by lokálny autentifikovaný útočník mohol zneužiť na eskaláciu privilégií na úroveň oprávnení SYSTEM. Pozn.: Podľa spoločnosti ESET je predmetná zraniteľnosť aktívne zneužívaná útočníkmi na šírenie malvéru PIPEMAGIC minimálne od marca 2023. | Podľa spoločnosti ESET je predmetná zraniteľnosť aktívne zneužívaná útočníkmi na šírenie malvéru PIPEMAGIC minimálne od marca 2023.
Critical Vulnerability in Windows Common Log File System (CLFS) CVE-2025-29824... Use after free in Windows Common Log File System Driver (CLFS) allows an authorised attacker to elevate privileges locally. Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware. | Microsoft have identified a threat actor group leveraging this flaw through the PipeMagic malware to gain SYSTEM-level access to perform post-exploitation activities such as credential dumping via LSASS and deploying ransomware.
The exploit for this vulnerability was executed by the PipeMagic malware, which we first discovered in December 2022 in a RansomExx ransomware campaign.
Ransomware groups and Chinese advanced persistent threat (APT) groups are targeting a critical vulnerability in SAP NetWeaver... The vulnerability, tracked as CVE-2025-31324, has a CVSS score of 10 and affects NetWeaver's Visual Composer development server. Threat actors can exploit the vulnerability using remote attacks to execute arbitrary code without authentication... SAP later confirmed it as an unrestricted file upload vulnerability... allowing attackers to upload malicious files directly to the system without authorization.
RansomEXX, also tracked as Storm-2460, is known for using the modular backdoor named PipeMagic. ReliaQuest observed the deployment of a PipeMagic sample beaconing to a known RansomEXX domain.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft researchers have detailed a modular backdoor framework called “PipeMagic,” used by threat actors to stealthily deploy ransomware.
Microsoft published a lengthy analysis of PipeMagic — a backdoor used by a threat actor they call Storm-2460... Once PipeMagic is running, the threat actor performs the CLFS exploit to escalate privileges before launching their ransomware.
"BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan"
27 distinct techniques documented for this family, organized by ATT&CK tactic.
After decryption, the resulting shellcode is executed via the WinAPI function EnumDeviceMonitor... with the shellcode dynamically resolving their addresses via GetProcAddress.
An example of executing this payload: c:\windows\system32\cmd.exe "/k c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe c:\windows\help\metafile.mshi"
To hinder analysis, the attackers hashed API functions using the FNV-1a algorithm... the loader contains obfuscated C# code and a very long hexadecimal string.
the attackers used a fake ChatGPT client application as bait... However, it had no user functionality – when launched, it simply displayed a blank screen.
This module, found in one of the infections, is responsible for injecting additional payloads into memory and executing them.
The library deploys the decrypted code into memory and transfers control to it, and the original file is subsequently deleted.
An example of executing this payload: c:\windows\system32\cmd.exe "/k c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe c:\windows\help\metafile.mshi"
the application extracted a 105,615-byte AES-encrypted array from its code, decrypted it, and executed it... The C# code serves two purposes – decrypting and executing the shellcode... the file contents are decrypted using the symmetric AES cipher in CBC mode
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as part of a related cleanup guide, not as part of the GigaWiper incident itself.
PipeMagic is a backdoor that provides remote access, can operate as a network gateway, supports plugin-based payload delivery and execution, uses named pipes and localhost communication for encrypted payload transfer, and has been observed using multiple loaders including trojanized Rufus, fake ChatGPT applications, .mshi/msbuild execution, and DLL hijacking.
Malware used in intrusion chain for RansomExx ransomware; deployed after exploiting a Windows CLFS privilege escalation flaw (CVE-2025-29824).
Trojan deployed after exploitation of SAP NetWeaver; also reported exploiting a Windows CLFS zero-day to deploy ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.