Urgent: Ransomware Gang Exploits Windows CLFS Zero-Day Vulnerability – What You Need to Know

Microsoft has recently warned that the RansomEXX ransomware gang is using a serious flaw in the Windows Common Log File System. This vulnerability, labeled as CVE-2025-29824, allows attackers to gain SYSTEM privileges, which can lead to significant control over affected systems.

This flaw was fixed in the latest security updates, but Microsoft admitted it has not yet released patches for Windows 10 x64 and 32-bit systems. These updates are coming soon, so users should keep an eye out.

The RansomEXX gang has targeted various sectors, including IT and real estate in the U.S., finance in Venezuela, a Spanish software company, and retail in Saudi Arabia. Thankfully, users running Windows 11, version 24H2 are safe from this exploit, although the weakness remains.

The attackers typically install a malware strain known as PipeMagic before using it to carry out further attacks, including deploying ransomware. Once files are encrypted, victims receive ransom notes named !_READ_MEREXX2!.txt.

PipeMagic first caught attention in 2022 and has been used to launch multiple campaigns since. It not only enables attackers to access sensitive data but also helps them move throughout a network undetected. Recently, Kaspersky reported that PipeMagic was involved in attacks tied to various zero-day vulnerabilities.

Historically, RansomEXX began its journey as Defray in 2018 but rebranded in June 2020, becoming increasingly active. They’ve targeted significant organizations, including GIGABYTE, Konica Minolta, and government agencies.

In today’s landscape, cybersecurity continues to evolve. A recent study found that 70% of organizations experienced a ransomware attack within the last year. As such, keeping systems updated and maintaining robust cybersecurity measures is crucial. For more details on these ongoing threats, check the resources at Microsoft’s security blog.

Source link