InfoSecBulletin Cybersecurity for mankind
Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization in the U.S. The attack occurred prior to the disclosure and patching of a Windows elevation of privilege zero-day vulnerability (CVE-2025-29824) in the Common Log File System Driver (clfs.sys) on April 8, 2025.
Although no ransomware payload was deployed in the intrusion, the attackers deployed the Grixba infostealer, which is a custom tool associated with Balloonfly, the attackers behind the Play ransomware operation.
Microsoft Patches Four Critical Azure and Power Apps Vulns
Qilin Ransomware topped April 2025 with 45+ data leak disclosures
SonicWall Patches 3 Flaws in SMA 100 Devices
Top Ransomware Actively Attacking Financial Sector: 406 Incidents Disclosed
Critical (CVSS 10) Flaw in Cisco IOS XE WLCs Allows RRA
CVE-2025-29824
Play Ransomware Exploited Windows CVE-2025-29824 as Zero-Day
Hacker exploited Samsung MagicINFO 9 Server RCE flaw
CISA adds Langflow flaw to its KEV catalog
Google Fixes Android Flaw (CVE-2025-27363) Exploited by Attackers
UAP hosted “UAP Cyber Siege 2025”, A national level cybersecurity competition
Balloonfly is a cybercrime group that has been active since at least June 2022 and uses the Play ransomware (also known as PlayCrypt) in attacks. The group has impacted a wide range of businesses and critical infrastructure in North America, South America, and Europe.
Attack analysis:
The initial infection vector may have been a public facing Cisco ASA firewall. The attackers moved by unknown means to another, Windows machine on the targeted network.
During the attack, the Balloonfly operators deployed a variety of samples and hacktools in addition to the Grixba infostealer and the exploit for CVE-2025-29824 on this machine. Some of the samples aren’t available to us at the moment of writing, but they were located in the Music folder with suspicious names masquerading as Palo Alto software (paloaltoconfig.exe, paloaltoconfig.dll) or, for example, 1day.exe.
To gather information on all the available machines in the victims’ Active Directory, the attackers executed the following command and saved the output to C:\Users\[REDACTED]\Music\AllWindows.csv file.
powershell Import-Module ActiveDirectory; Get-ADComputer -Filter {enabled -eq $true} -properties *|select comment, description, Name, DNSHostName, OperatingSystem, LastLogonDate, ipv4address | Export-CSV C:\Users\[REDACTED]\Music\AllWindows.csv -NoTypeInformation -Encoding UTF8
Exploitation by multiple actors:
The exploit (or similar exploits) may have been in the hands of multiple actors prior to the patching of CVE-2025-29824. When patching the vulnerability, Microsoft said that it had been exploited against a “small number of targets,” including organizations in the U.S., Venezuela, Spain, and Saudi Arabia. Microsoft said that the exploit had been deployed by the PipeMagic malware, which is often used by a group called Storm-2460 to deploy ransomware.
The nature of the exploitation by Storm-2460 appears different from the Balloonfly-linked activity discovered by Symantec. Microsoft said that the exploit had been launched in memory from a dllhost.exe process. The exploitation discovered by Symantec was not fileless.
Rare ransomware zero-day:
While the use of zero-day vulnerabilities by ransomware actors is rare, it is not unprecedented. Last year Symantec found evidence that attackers linked to the Black Basta ransomware may have been exploiting a recently patched Windows privilege escalation vulnerability (CVE-2024-26169) as a zero-day.
That vulnerability was patched on March 12, 2024, and, at the time, Microsoft said there was no evidence of its exploitation in the wild. However, analysis of an exploit tool revealed evidence that it could have been compiled prior to patching, meaning at least one group may have been exploiting the vulnerability as a zero-day.
Source: Symentec
