Storm-2460

Executive Summary

Storm‑2460 is a financially driven threat actor that leveraged the zero‑day CVE‑2025‑29824 in Windows CLFS to achieve privilege escalation and deploy the PipeMagic modular backdoor. They use certutil to download malicious code from compromised legitimate sites, then inject ransomware such as Medusa that encrypts files and drops an unmistakable ransom note. The actor targets a wide range of sectors across North America, Europe, Asia‑Pacific and the Middle East.

Goals & Targeting

Storm‑2460 aims primarily at financial gain through ransomware payments. The actor targets sectors with high-value data and regulatory pressure—including finance, healthcare, energy, defense, and critical infrastructure—across geographies such as the United States, Europe, the Middle East, South America, and parts of Asia‑Pacific. By exploiting a zero‑day Windows kernel flaw and using legitimate system tools for delivery, they achieve quick compromise and stealth, making lucrative targets more likely to succeed and comply with ransom demands.

Key Capabilities

• Zero‑day exploitation of CLFS (CVE-2025-29824) to gain local privilege escalation
• Use of native Windows utilities such as certutil and rundll32 for file download and execution
• Deployment of the modular PipeMagic backdoor with built‑in ransomware components like Medusa
• Persistence via scheduled tasks, custom services, DLL hijacking and modification of registry keys
• Lateral movement through WMI queries, Remote Desktop, and DLL injection (T1574.001)
• Credential theft using keyloggers, LSASS memory extraction, and credential dumping tools
• Defense evasion by bypassing UAC, disabling logging and file‑deletion techniques
• Data exfiltration and C2 via PowerShell scripts and custom protocols

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Storm‑2460 has maintained activity across multiple wave attacks, typically launching a zero‑day exploitation followed by rapid installation of PipeMagic and ransomware on the same host. Their campaigns have spanned several continents, demonstrating agility in pivoting between different sectors (IT, finance, real estate) within short windows. Observed operational tempo suggests quick compromise-to-cash cycles—often only days from initial intrusion to ransom payment—highlighting a focus on immediate financial payoff rather than long‑term espionage.

IOC Patterns

• Spearphishing attachment containing an MSBuild payload hosted from a compromised legitimate website
• Use of certutil command line for downloading malicious binaries
• In-memory execution via rundll32 or PowerShell after CLFS privilege escalation
• Deployment of PipeMagic backdoor with modular ransomware modules (e.g., Medusa)
• Ransomware note named !\_READ_ME_REXX2_.txt on victim machines

Recommended Actions

• Apply the security update that patches CVE-2025-29824 immediately
• Disable or harden CLFS logging features to reduce exploitation surface area
• Block or strictly monitor certutil usage in corporate environments (whitelisting policies)
• Implement detection of rundll32 and PowerShell scripts that load DLLs from temporary paths
• Enable user‑account control auditing and restrict local privilege escalation rights
• Use endpoint protection with memory‑detection capabilities against known PipeMagic signatures
• Establish and test ransomware containment playbooks, including backup isolation and network segmentation

Suggested Tags