Microsoft Threat Intelligence delivers a comprehensive technical breakdown of PipeMagic, a modular backdoor leveraged by Storm-2460, focusing on its architecture, exploitation methods, and mitigation strategies for security professionals.

Dissecting PipeMagic: Inside the Architecture of a Modular Backdoor Framework

Author: Microsoft Threat Intelligence

Overview

PipeMagic is a modular, stealthy backdoor attributed to threat actor Storm-2460, observed masquerading as a legitimate ChatGPT Desktop Application. This technical deep dive explores its deployment methods, internal architecture, sophisticated payload delivery, and robust command-and-control (C2) communications, providing essential insights for defenders and incident responders.

Key Features of PipeMagic

  • Highly modular backdoor: Can execute dynamically loaded payload modules.
  • Robust C2 networking: Uses a dedicated, extensible network module, relying on named pipes for inter-process communication and remote orchestration.
  • Detection Evasion: Leverages multiple linked list structures to manage payloads and communications, making analysis and detection challenging.
  • Ransomware Deployment: Used in targeted zero-day exploitation (CVE-2025-29824, Windows CLFS) to escalate privilege and distribute ransomware.

Technical Execution Flow

Infection & Initial Access

  • Delivered via trojanized open-source ChatGPT Desktop Application (GitHub project link embedded with malicious code).
  • Payload dropped using a malicious MSBuild file; executed in-memory.
  • Actor exploits CVE-2025-29824 for privilege escalation, then launches ransomware.

Linked List Management

  • Payload Linked List: Stores raw payload modules (Windows PE format).
  • Execute Linked List: Manages modules loaded for execution.
  • Network Linked List: Handles discrete modules for C2 communication.
  • Unknown Linked List: Purpose unclear but likely used for auxiliary module management.

Each node contains information such as module index, hash, attributes (encryption/compression), and memory pointers.

Communication & Control

  • Establishes bidirectional named pipes (format: \\.\pipe\1.<Bot ID>) for payload module transfers.
  • Payloads delivered in encrypted and integrity-checked blocks (RC4 + SHA-1).
  • On memory load, modules are managed in doubly linked lists for flexible operation.
  • Configuration delivered in structured blocks, including primary C2 domain (aaaaabbbbbbb.eastus.cloudapp.azure.com:443).

Networking Module

  • C2 functionality is delegated to a specialized module (XOR decryption + aPLib decompression).
  • Initiates WebSocket-like connections to the C2, using randomized HTTP GET requests.
  • Registers exported functions for C2 communication, termination, and global control.

System Reconnaissance

  • Collects host identifiers, OS and process information, domain details, and environmental context.
  • Sends metadata about loaded modules (both payload and unknown).

Command Execution

  • Accepts a range of granular C2 commands for module management, execution (including self-deletion), system enumeration, and dynamic payload manipulation.
  • Supports complex operations such as in-memory loading, hash-verified updates, and remote payload replacement.

Mitigation and Protection

  • Use Microsoft Defender for Endpoint features: Tamper protection, Network protection, EDR in block mode, cloud-delivered protection, and automated remediation.
  • Monitor for Defender alerts indicating PipeMagic activity.
  • Use Defender Vulnerability Management for exposure analysis, and Security Copilot for investigation and response.

Microsoft Defender Detections

  • Antivirus: Detects PipeMagic as Win32/64 malware.
  • Endpoint: Alerts on detection, blocking, and process termination of PipeMagic.
  • Vulnerability Management: Surfaces devices vulnerable to CVE-2025-29824.
  • Security Copilot: Provides promptbooks for automated incident analysis and threat hunting.

Indicators of Compromise

Type Indicator
Domain aaaaabbbbbbb.eastus.cloudapp.azure[.]com:443
File SHA-256 hashes dc54117b965674bad3d7cd203ecf5e7fc822423a3f692895cf5e96e83fb88f6a (trojanized loader)
  4843429e2e8871847bc1e97a0f12fa1f4166baa4735dff585cb3b4736e3fe49e (PipeMagic in memory)
  297ea881aa2b39461997baf75d83b390f2c36a9a0a4815c81b5cf8be42840fd1 (network module)

References

Further Learning

By exposing PipeMagic’s architecture and techniques, security professionals can better detect, disrupt, and defend against this and similar modular backdoor threats.

This post appeared first on “Microsoft Security Blog”. Read the entire article here