Evolution of the PipeMagic backdoor: from the RansomExx incident to CVE-2025-29824

Kaspersky and BI.ZONE jointly analyze PipeMagic — a persistent Windows backdoor observed since 2022 — documenting new 2025 infections in the Middle East and Brazil. The report describes diverse initial access and loader techniques (trojanized utilities, fake ChatGPT client, .mshi via msbuild, DLL hijacking), AES/RC4-encrypted shellcode execution, local named-pipe and localhost network communications, plugin modules for I/O, loaders and injectors, AMSI bypass and LSASS memory dumping (ProcDump) for credential theft, and ties to exploitation of CVE-2025-29824 and RansomExx activity; it concludes with IoCs (hashes, domain, pipe names) for detection and response.