A recent cyber attack targeting an organization in the United States involved threat actors associated with the Play ransomware family exploiting a zero-day vulnerability in Microsoft Windows. The attack utilized CVE-2025-29824, a privilege escalation flaw in the Common Log File System (CLFS) driver that was patched by Microsoft last month. Play ransomware, also known as Balloonfly and PlayCrypt, is notorious for its double extortion tactics, where sensitive data is stolen and then encrypted for ransom.
Symantec’s Threat Hunter Team observed that the attackers likely gained access through a public-facing Cisco Adaptive Security Appliance (ASA) and then moved to another Windows machine on the target network using an undisclosed method. The attack involved the use of Grixba, a custom information stealer attributed to Play, and an exploit for CVE-2025-29824 disguised as Palo Alto Networks software.
During the attack, the threat actors collected information on all available machines in the victims’ Active Directory and saved the results to a CSV file. Although no ransomware payload was deployed in this intrusion, it highlights the use of zero-day exploits by ransomware actors to infiltrate targets. This trend was also seen with the Black Basta group exploiting a privilege escalation vulnerability as a zero-day in the past.
In another incident, threat actors utilized a local bypass technique called Bring Your Own Installer to disable endpoint security software and deploy the Babuk ransomware. This technique targeted SentinelOne’s EDR system by exploiting a flaw in the upgrade/downgrade process of the SentinelOne agent. The attackers gained local administrative access on a publicly-accessible server to carry out the attack.
Ransomware attacks have evolved with new trends such as targeting domain controllers to breach organizations and gain access to privileged accounts for mass encryption. Additionally, Ransomware-as-a-Service (RaaS) platforms like PlayBoy Locker have emerged, offering cybercriminals tools and support for launching ransomware attacks. The rise of ransomware cartels like DragonForce indicates a shift towards organized cybercrime in the ransomware landscape.
Source link