PipeMagic Backdoor Resurfaces as Part of Play Ransomware Attack Chain

Microsoft and other researchers observed the Storm-2460/Play group exploiting a Windows CLFS zero-day (CVE-2025-29824) to escalate privileges and deploy the PipeMagic modular backdoor—packaged as a fake ChatGPT Desktop app—which fetches modules via named pipes and communicates with C2 to enable persistence, lateral movement, and ransomware deployment; activity has been seen across IT, financial, real estate and manufacturing sectors in multiple regions. Organizations are advised to apply the April patch for CVE-2025-29824, enable Microsoft Defender tamper and network protection, run EDR in block mode, enable automated investigation/remediation, and turn on cloud-delivered protections to reduce exposure.