InfoSecBulletin Cybersecurity for mankind
Attackers linked to the Play ransomware operation deployed a zero-day privilege escalation exploit during an attempted attack against an organization in the U.S. The attack occurred prior to the disclosure and patching of a Windows elevation of privilege zero-day vulnerability (CVE-2025-29824) in the Common Log File System Driver (clfs.sys) on April 8, 2025.
Although no ransomware payload was deployed in the intrusion, the attackers deployed the Grixba infostealer, which is a custom tool associated with Balloonfly, the attackers behind the Play ransomware operation.
India’s Tata Electronics hit by cyber breach: Hacker target 630 GB record
Anthropic’s Mythos reportedly broke NSA classified systems in hours
OpenAI New Method “Deployment Simulation” Predicts AI Risks Before Deployment
AryStinger botnet infected thousands of D-Link routers globally
Hacker suspected of sending alerts across Brazil
CyberSentinel AI features 33 security tools like Nmap, SQLMap, and ZAP, utilizing Claude and GPT
Barracuda hosts Dhaka roundtable on cyber resilience
CISA Alerts Fortinet Users as FortiBleed Affects 86,644 FortiGate Devices
CISA: Splunk flaw under active exploit, patch by Sunday
Texas data breach exposes 3 million driver’s licenses
Balloonfly is a cybercrime group that has been active since at least June 2022 and uses the Play ransomware (also known as PlayCrypt) in attacks. The group has impacted a wide range of businesses and critical infrastructure in North America, South America, and Europe.
Attack analysis:
The initial infection vector may have been a public facing Cisco ASA firewall. The attackers moved by unknown means to another, Windows machine on the targeted network.
During the attack, the Balloonfly operators deployed a variety of samples and hacktools in addition to the Grixba infostealer and the exploit for CVE-2025-29824 on this machine. Some of the samples aren’t available to us at the moment of writing, but they were located in the Music folder with suspicious names masquerading as Palo Alto software (paloaltoconfig.exe, paloaltoconfig.dll) or, for example, 1day.exe.
To gather information on all the available machines in the victims’ Active Directory, the attackers executed the following command and saved the output to C:\Users\[REDACTED]\Music\AllWindows.csv file.
powershell Import-Module ActiveDirectory; Get-ADComputer -Filter {enabled -eq $true} -properties *|select comment, description, Name, DNSHostName, OperatingSystem, LastLogonDate, ipv4address | Export-CSV C:\Users\[REDACTED]\Music\AllWindows.csv -NoTypeInformation -Encoding UTF8
Exploitation by multiple actors:
The exploit (or similar exploits) may have been in the hands of multiple actors prior to the patching of CVE-2025-29824. When patching the vulnerability, Microsoft said that it had been exploited against a “small number of targets,” including organizations in the U.S., Venezuela, Spain, and Saudi Arabia. Microsoft said that the exploit had been deployed by the PipeMagic malware, which is often used by a group called Storm-2460 to deploy ransomware.
The nature of the exploitation by Storm-2460 appears different from the Balloonfly-linked activity discovered by Symantec. Microsoft said that the exploit had been launched in memory from a dllhost.exe process. The exploitation discovered by Symantec was not fileless.
Rare ransomware zero-day:
While the use of zero-day vulnerabilities by ransomware actors is rare, it is not unprecedented. Last year Symantec found evidence that attackers linked to the Black Basta ransomware may have been exploiting a recently patched Windows privilege escalation vulnerability (CVE-2024-26169) as a zero-day.
That vulnerability was patched on March 12, 2024, and, at the time, Microsoft said there was no evidence of its exploitation in the wild. However, analysis of an exploit tool revealed evidence that it could have been compiled prior to patching, meaning at least one group may have been exploiting the vulnerability as a zero-day.
Source: Symentec
