Microsoft: Windows CLFS Vulnerability Could Lead to ‘Widespread Deployment and Detonation of Ransomware’

**Zero-day CLFS privilege-escalation exploited in the wild leading to ransomware by Storm-2460 (RansomEXX).** Microsoft reported CVE-2025-29824 in the Windows CLFS driver being exploited to escalate standard-user access to SYSTEM, enabling deployment of PipeMagic (remote control/malware) and subsequent ransomware that encrypts files and drops a ransom note (!_READ_ME_REXX2_!.txt); exploitation involved certutil/MSBuild to load an encrypted payload, token overwrites via dllhost.exe, LSASS memory dumping with procdump, and observed IOCs including a compromised Azure-hosted domain.