www.trendmicro.com
Open in
urlscan Pro
104.75.88.80
Public Scan
URL:
https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-magniber
Submission: On March 22 via api from DE — Scanned from DE
Submission: On March 22 via api from DE — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___CuInf">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>Text Content
Business
search close
* Solutions
* By Challenge
* By Challenge
* By Challenge
Learn more
* Understand, Prioritize & Mitigate Risks
* Understand, Prioritize & Mitigate Risks
Improve your risk posture with attack surface management
Learn more
* Protect Cloud-Native Apps
* Protect Cloud-Native Apps
Security that enables business outcomes
Learn more
* Protect Your Hybrid World
* Protect Your Hybrid, Multi-Cloud World
Gain visibility and meet business needs with security
Learn more
* Securing Your Borderless Workforce
* Securing Your Borderless Workforce
Connect with confidence from anywhere, on any device
Learn more
* Eliminate Network Blind Spots
* Eliminate Network Blind Spots
Secure users and key operations throughout your environment
Learn more
* See More. Respond Faster.
* See More. Respond Faster.
Move faster than your adversaries with powerful purpose-built XDR,
attack surface risk management, and zero trust capabilities
Learn more
* Extend Your Team
* Extend Your Team. Respond to Threats Agilely
Maximize effectiveness with proactive risk reduction and managed
services
Learn more
* Operationalizing Zero Trust
* Operationalizing Zero Trust
Understand your attack surface, assess your risk in real time, and
adjust policies across network, workloads, and devices from a single
console
Learn more
* By Role
* By Role
* By Role
Learn more
* CISO
* CISO
Drive business value with measurable cybersecurity outcomes
Learn more
* SOC Manager
* SOC Manager
See more, act faster
Learn more
* Infrastructure Manager
* Infrastructure Manager
Evolve your security to mitigate threats quickly and effectively
Learn more
* Cloud Builder and Developer
* Cloud Builder and Developer
Ensure code runs only as intended
Learn more
* Cloud Security Ops
* Cloud Security Ops
Gain visibility and control with security designed for cloud
environments
Learn more
* By Industry
* By Industry
* By Industry
Learn more
* Healthcare
* Healthcare
Protect patient data, devices, and networks while meeting regulations
Learn more
* Manufacturing
* Manufacturing
Protecting your factory environments – from traditional devices to
state-of-the-art infrastructures
Learn more
* Oil & Gas
* Oil & Gas
ICS/OT Security for the oil and gas utility industry
Learn more
* Electric Utility
* Electric Utility
ICS/OT Security for the electric utility
Learn more
* Federal
* Federal
Learn more
* Automotive
* Automotive
Learn more
* 5G Networks
* 5G Networks
Learn more
* Small & Midsized Business Security
* Small & Midsized Business Security
Stop threats with comprehensive, set-it-and-forget-it protection
Learn more
* Platform
* Vision One Platform
* Vision One Platform
* Trend Vision One
Our Unified Platform
Bridge threat protection and cyber risk management
Learn more
* AI Companion
* Trend Vision One Companion
Your generative AI cybersecurity assistant
Learn more
* Attack Surface Management
* Attack Surface Management
Stop breaches before they happen
Learn more
* XDR (Extended Detection & Response)
* XDR (Extended Detection & Response)
Stop adversaries faster with a broader perspective and better context to
hunt, detect, investigate, and respond to threats from a single platform
Learn more
* Cloud Security
* Cloud Security
* Trend Vision One™
Cloud Security Overview
The most trusted cloud security platform for developers, security
teams, and businesses
Learn more
* Attack Surface Risk Management for Cloud
* Attack Surface Risk Management for Cloud
Cloud asset discovery, vulnerability prioritization, Cloud Security
Posture Management, and Attack Surface Management all in one
Learn more
* XDR for Cloud
* XDR for Cloud
Extend visibility to the cloud and streamline SOC investigations
Learn more
* Workload Security
* Workload Security
Secure your data center, cloud, and containers without compromising
performance by leveraging a cloud security platform with CNAPP
capabilities
Learn more
* Container Security
* Container Security
Simplify security for your cloud-native applications with advanced
container image scanning, policy-based admission control, and container
runtime protection
Learn more
* File Storage Security
* File Storage Security
Security for cloud file/object storage services leveraging cloud-native
application architectures
Learn more
* Endpoint Security
* Endpoint Security
* Endpoint Security Overview
Defend the endpoint through every stage of an attack
Learn more
* XDR for Endpoint
* XDR for Endpoint
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Workload Security
* Workload Security
Optimized prevention, detection, and response for endpoints, servers,
and cloud workloads
Learn more
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Mobile Security
* Mobile Security
On-premises and cloud protection against malware, malicious
applications, and other mobile threats
Learn more
* Network Security
* Network Security
* Network Security Overview
Expand the power of XDR with network detection and response
Learn more
* XDR for Network
* XDR for Network
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Network Intrusion Prevention (IPS)
* Network Intrusion Prevention (IPS)
Protect against known, unknown, and undisclosed vulnerabilities in your
network
Learn more
* Breach Detection System (BDS)
* Breach Detection System (BDS)
Detect and respond to targeted attacks moving inbound, outbound, and
laterally
Learn more
* Secure Service Edge (SSE)
* Secure Service Edge (SSE)
Redefine trust and secure digital transformation with continuous risk
assessments
Learn more
* Industrial Network Security
* Industrial Network Security
Learn more
* 5G Network Security
* 5G Network Security
Learn more
* Email Security
* Email Security
* Email Security
Stop phishing, malware, ransomware, fraud, and targeted attacks from
infiltrating your enterprise
Learn more
* Email and Collaboration Security
* Trend Vision One™
Email and Collaboration Security
Stop phishing, ransomware, and targeted attacks on any email service
including Microsoft 365 and Google Workspace
Learn more
* OT Security
* OT Security
* OT Security
Learn about solutions for ICS / OT security.
Learn more
* XDR for OT
* XDR for OT
Stop adversaries faster with a broader perspective and better context
to hunt, detect, investigate, and respond to threats from a single
platform
Learn more
* Industrial Network Security
* Industrial Network Security
Industrial Network Security
* Industrial Endpoint Security
* Industrial Endpoint Security
Learn more
* Threat Intelligence
* Threat Intelligence
Keep ahead of the latest threats and protect your critical data with
ongoing threat prevention and analysis
Learn more
* All Products, Services, and Trials
* All Products, Services, and Trials
Learn more
* Research
* Research
* Research
* Research
Learn more
* Research, News, and Perspectives
* Research, News, and Perspectives
Learn more
* Research and Analysis
* Research and Analysis
Learn more
* Security News
* Security News
Learn more
* Zero Day Initiatives (ZDI)
* Zero Day Initiatives (ZDI)
Learn more
* Services
* Our Services
* Our Services
* Our Services
Learn more
* Service Packages
* Service Packages
Augment security teams with 24/7/365 managed detection, response, and
support
Learn more
* Managed XDR
* Managed XDR
Augment threat detection with expertly managed detection and response
(MDR) for email, endpoints, servers, cloud workloads, and networks
Learn more
* Incident Response
* Incident Response
* Incident Response
Our trusted experts are on call whether you're experiencing a breach
or looking to proactively improve your IR plans
Learn more
* Insurance Carriers and Law Firms
* Insurance Carriers and Law Firms
Stop breaches with the best response and detection technology on the
market and reduce clients’ downtime and claim costs
Learn more
* Support Services
* Support Services
Learn more
* Partners
* Partner Program
* Partner Program
* Partner Program Overview
Grow your business and protect your customers with the best-in-class
complete, multilayered security
Learn more
* Managed Security Service Provider
* Managed Security Service Provider
Deliver modern security operations services with our industry-leading
XDR
Learn more
* Managed Service Provider
* Managed Service Provider
Partner with a leading expert in cybersecurity, leverage proven
solutions designed for MSPs
Learn more
* Cloud Service Provider
* Cloud Service Provider
Add market-leading security to your cloud service offerings – no matter
which platform you use
Learn more
* Professional Services
* Professional Services
Increase revenue with industry-leading security
Learn more
* Resellers
* Resellers
Discover the possibilities
Learn more
* Marketplace
* Marketplace
Learn more
* System Integrators
* System Integrators
Learn more
* Alliance Partners
* Alliance Partners
* Alliance Overview
We work with the best to help you optimize performance and value
Learn more
* Technology Alliance Partners
* Technology Alliance Partners
Learn more
* Our Alliance Partners
* Our Alliance Partners
Learn more
* Partner Tools
* Partner Tools
* Partner Tools
Learn more
* Partner Login
* Partner Login
Login
* Education and Certification
* Education and Certification
Learn more
* Partner Successes
* Partner Successes
Learn more
* Distributors
* Distributors
Learn more
* Find a Partner
* Find a Partner
Learn more
* Company
* Why Trend Micro
* Why Trend Micro
* Why Trend Micro
Learn more
* Customer Success Stories
* Customer Success Stories
Learn more
* The Human Connection
* The Human Connection
Learn more
* Industry Accolades
* Industry Accolades
Learn more
* Strategic Alliances
* Strategic Alliances
Learn more
* Compare Trend Micro
* Compare Trend Micro
Learn more
* About Us
* About Us
* About Us
Learn more
* Trust Center
* Trust Center
Learn more
* History
* History
Learn more
* Diversity, Equity and Inclusion
* Diversity, Equity and Inclusion
Learn more
* Corporate Social Responsibility
* Corporate Social Responsibility
Learn more
* Leadership
* Leadership
Learn more
* Security Experts
* Security Experts
Learn more
* Internet Safety and Cybersecurity Education
* Internet Safety and Cybersecurity Education
Learn more
* Legal
* Legal
Learn more
* Investors
* Investors
Learn more
* Formula E Racing
* Formula E Racing
Learn more
* Latest News
* Latest News
* Latest News
Learn more
* Newsroom
* Newsroom
Learn more
* Events
* Events
Learn more
* Careers
* Careers
Learn more
* Webinars
* Webinars
Learn more
Back
Back
Back
Back
* Free Trials
* Contact Us
Looking for home solutions?
Under Attack?
Support
* Business Support Portal
* Business Community
* Virus and Threat Help
* Education and Certification
* Contact Support
* Find a Support Partner
Resources
* Cyber Risk Index/Assessment
* CISO Resource Center
* DevOps Resource Center
* What Is?
* Threat Encyclopedia
* Cloud Health Assessment
* Cyber Insurance
* Glossary of Terms
* Webinars
Log In
* Support
* Partner Portal
* Cloud One
* Product Activation and Management
* Referral Affililate
Back
arrow_back
search
close
* Security News
* Ransomware Spotlight
* Ransomware Spotlight: Magniber
RANSOMWARE SPOTLIGHT: MAGNIBER
X
Magniber
January 26, 2023
* Email
* Facebook
* Twitter
* Google+
* Linkedin
By Trend Micro Research
The Magniber ransomware initially targeted only Asian countries when it was
first detected in 2017. However, it resurfaced in 2021 and continues to operate
today with expanded targets around the globe. Magniber remains a significant
player in the threat landscape, with malicious attackers likely to continue
using the ransomware in future.
View infographic of "Ransomware Spotlight: Magniber"
Despite first being detected six years ago, malicious attackers continue to use
the Magniber ransomware to compromise organizations. In October 2022, phishing
attacks were reported to distribute the Magniber ransomware using standalone
JavaScript files digitally signed with a malformed key, exploiting the zero-day
vulnerability CVE-2022-44698 to bypass Mark-of-the-Web (MOTW) security warnings,
and allowing malicious files to be executed without raising alerts. Microsoft
later patched this vulnerability in December 2022.
Formerly known as a successor of Cerber, the Magniber ransomware was primarily
distributed via the Magnitude exploit kit and exclusively targeted South Korea
in 2017. In 2018, it expanded its targets across Asia using CVE-2018-8174 for
initial access.
WHAT ORGANIZATIONS NEED TO KNOW ABOUT THE MAGNIBER RANSOMWARE
After its initial discovery in 2017, Magniber resurfaced in 2021. Although it
still targeted Asian countries, we found it exploiting new vulnerabilities for
initial access, including CVE-2021-26411, CVE-2021-40444, and most notably the
PrintNightmare vulnerability, CVE-2021-34527.
As of writing, there are no known leak sites related to Magniber, which follows
the ransomware-as-aservice (RaaS) business model but is not involved in the more
talked-about and recent double-extortion ransomware campaigns.
Magniber was also previously known to use typosquatting, a technique that
involves using domains similar to legitimate websites to lure users into
downloading a ransomware payload. We also observed Magniber distributing itself
through fake installers with APPX and MSI formats in the first quarter of 2022.
Attackers use the MSI CustomAction table to execute the Magniber ransomware by
calling the export of the malicious DLL in the MSI package. The installer
additionally drops the malicious binary file we detected as Fodscript, a piece
of malware used for privileged escalation. Fodscript drops two script files: The
first modifies the registry entries checked in by fodhelper.exe to manipulate it
into executing the second script with high privilege. Afterward, it bypasses
User Account Control (UAC) to delete volume shadow copies in the compromised
machine.
We also observed Magniber posing as fake installers and Windows updates to lure
users into selecting the malicious payload. Additionally, we observed that
Magniber recently incorporated malformed digital signatures to bypass execution
blocks by MOTW, thus allowing easy installation of the ransomware payload.
Though we have yet to encounter this tactic in cases we detected, the group
behind Magniber was observed as using the COVID-19 surge in the last months of
2022 to distribute its payloads through COVID-19 file lures, alongside its
aforementioned tactics. Magniber was also recently found bypassing MOTW and
exploiting CVE-2022-44698 using a fake digital signature.
TOP AFFECTED COUNTRIES AND INDUSTRIES
ACCORDING TO TREND MICRO DATA
In this section, we examine the Magniber ransomware’s attempts to compromise
organizations in 2022 based on Trend Micro™ Smart Protection Network™ country
and regional data. It’s important to note that this data covers only Trend Micro
customers and does not contain all victims of Magniber.
Malicious attackers behind Magniber started slow in 2022, with less than 20
attacks per month in the first quarter of the year. The attack attempts steadily
increased as the year progressed, with attackers making the most of September
2022, which recorded the largest number of attack attempts at 1,482 detections.
Attack attempts diminished during the last quarter of the year but remained high
with 508 detections in December. The following figure details the total number
of attempted attacks by Magniber in 2022.
Figure 1. A monthly breakdown of Magniber attack attempts in terms of infected
machines in 2022
Source: Trend Micro™ Smart Protection Network™
--------------------------------------------------------------------------------
The highest number of Magniber attacks was detected in Taiwan with a total of
204 attack attempts, which makes up most of the attack attempt detections at
approximately 76.1% of the total. South Korea, initially targeted by Magniber
when it was first detected, has the second most attack attempts with a large
margin at 15, followed by Australia with nine. Turkey and Japan follow with six
detections each. Our data shows that Magniber has expanded its targets beyond
Asian countries. Note that the data in Figure 2 is limited to feedback provided
by customers, majority of whom preferred not to disclose their locations.
Figure 2. The top 10 countries with the highest number of attack attempts in
terms of infected machines for the Magniber ransomware (Jan. 1, 2022 to Dec. 31,
2022) Source: Trend Micro Smart Protection Network
--------------------------------------------------------------------------------
Industry data, on the other hand, showed that educational organizations, the
government, and manufacturing industries experienced the largest number of
Magniber ransomware attack attempts, followed by the healthcare and technology
industries. Other industries that experienced less attempted attacks were the
energy, transportation, and real estate industries.
In total, there were 987 total detections of Magniber attack attempts across
industries in 2022 from customer feedback detailing the industries in which they
belong.
Figure 3. An industry breakdown of Magniber ransomware attack attempts in terms
of infected machines (Jan. 1, 2022 to Dec. 31, 2022)
Source: Trend Micro Smart Protection Network
INFECTION CHAIN AND TECHNIQUES
We found that the Magniber ransomware exploits different vulnerabilities, but
while it uses a more straightforward kill chain compared to the newer
double-extortion ransomware campaigns, its simplicity does not make it any less
effective. The following figure details various vulnerabilities exploited to
deliver its payload:
Figure 4. Vulnerabilities exploited to deliver Magniber ransomware
INITIAL ACCESS
* Magniber threat actors leverage different vulnerabilities for initial access
such as the aforementioned Magnitude exploit kit (CVE-2016-0189,
CVE-2018-8174, and CVE-2019-1367), the Internet Explorer Scripting Engine
Memory Corruption Vulnerability (CVE-2020-0968), the Internet Explorer Memory
Corruption Vulnerability (CVE-2021-26411), the Internet Explorer remote code
execution (RCE) vulnerability in MSHTML (CVE-2021-40444), and PrintNightmare
(CVE-2021-34527).
COMMAND AND CONTROL
* Magniber has the capability to send collected information to its command and
control (C&C) and the payment browser.
DEFENSE EVASION
* Magniber injects itself to all processes except iexplore.exe and excluding
system and processes not running in a WoW64 environment. The ransomware uses
NtQuerySystemInformation API to obtain running processes in the machine.
* Recent Magniber infections leverage fake installers (.msi) by calling the
encrypted ransomware DLL through the CustomAction table, as well as the CPL
file format to execute its payload.
* Magniber uses a malformed digital signature block to bypass execution blocks
by MOTW. Recently, it was found exploiting CVE-2022-44698 to bypass MOTW with
a fake digital signature.
* It uses a file detected as Fodscript that drops a script file to delete
shadow copies from the target machine.
DISCOVERY
* Magniber uses NtQuerySystemInformation API to obtain running processes in the
machine.
* It searches for specific files, folders, and attributes and encrypts them if
they match its specified criteria.
PRIVILEGE ESCALATION
* Magniber uses a file detected as Fodscript that drops two script files: One
of the script files modifies the registry entries that fodhelper.exe checks
in order to manipulate fodhelper.exe into executing the second script with
high privilege and bypassing UAC.
COLLECTION, EXFILTRATION
* As of now, there are no data exfiltration and leaks being done by Magniber.
IMPACT
* The final ransomware binary would then be deployed, thereby ensuring that
files are encrypted in the machine. It also ensures that shadow copies are
deleted to inhibit system recovery.
* It initially encrypts target files via symmetric AES, then encrypts the AES
symmetric key and IV via RSA using CryptoAPIs. It encrypts equal-size data
blocks (1,048,576 bytes) per iteration until the final block is encrypted.
* It appends the mutex name as its appended extension.
* It can also delete shadow copies in the infected machine.
OTHER TECHNICAL DETAILS
* Magniber encrypts files with the following extensions:
* .abm
* .abs
* .abw
* .accdb
* .act
* .adn
* .adp
* .aes
* .aft
* .afx
* .agif
* .agp
* .ahd
* .ai
* .aic
* .aim
* .albm
* .alf
* .ans
* .apd
* .apm
* .apng
* .aps
* .apt
* .apx
* .arc
* .art
* .arw
* .asc
* .ase
* .asf
* .ask
* .asm
* .asp
* .asw
* .asy
* .aty
* .avi
* .awdb
* .awp
* .awt
* .aww
* .azz
* .bad
* .bak
* .bay
* .bbs
* .bdb
* .bdp
* .bdr
* .bean
* .bib
* .bmp
* .bmx
* .bna
* .bnd
* .boc
* .bok
* .brd
* .brk
* .brn
* .brt
* .bss
* .btd
* .bti
* .btr
* .c
* .ca
* .cals
* .can
* .cd
* .cdb
* .cdc
* .cdg
* .cdmm
* .cdmt
* .cdmz
* .cdr
* .cdt
* .cf
* .cfu
* .cgm
* .cimg
* .cin
* .cit
* .ckp
* .class
* .clkw
* .cma
* .cmx
* .cnm
* .cnv
* .colz
* .cpc
* .cpd
* .cpg
* .cpp
* .cps
* .cpx
* .crd
* .crt
* .crw
* .cs
* .csr
* .csv
* .csy
* .ct
* .cvg
* .cvi
* .cvs
* .cvx
* .cwt
* .cxf
* .cyi
* .dad
* .daf
* .db
* .dbc
* .dbf
* .dbk
* .dbs
* .dbt
* .dbv
* .dbx
* .dca
* .dcb
* .dch
* .dcr
* .dcs
* .dct
* .dcx
* .dd
* .dds
* .ded
* .der
* .dgn
* .dgs
* .dgt
* .dhs
* .dib
* .dif
* .dip
* .diz
* .djv
* .djvu
* .dmi
* .dmo
* .dnc
* .dne
* .doc
* .docb
* .docm
* .docx
* .docz
* .dot
* .dotm
* .dotx
* .dpp
* .dpx
* .dqy
* .drw
* .drz
* .dsk
* .dsn
* .dsv
* .dt
* .dta
* .dtsx
* .dtw
* .dv
* .dvi
* .dwg
* .dx
* .dxb
* .dxf
* .eco
* .ecw
* .ecx
* .edb
* .efd
* .egc
* .eio
* .eip
* .eit
* .em
* .emd
* .emf
* .emlx
* .ep
* .epf
* .epp
* .eps
* .epsf
* .eq
* .erf
* .err
* .etf
* .etx
* .euc
* .exr
* .fa
* .faq
* .fax
* .fb
* .fbx
* .fcd
* .fcf
* .fdf
* .fdr
* .fds
* .fdt
* .fdx
* .fdxt
* .fes
* .fft
* .fi
* .fic
* .fid
* .fif
* .fig
* .fla
* .flr
* .flv
* .fmv
* .fo
* .fodt
* .fpos
* .fpt
* .fpx
* .frm
* .frt
* .frx
* .ftn
* .fwdn
* .fxc
* .fxg
* .fzb
* .fzv
* .gcdp
* .gdb
* .gdoc
* .gem
* .geo
* .gfb
* .gfie
* .ggr
* .gif
* .gih
* .gim
* .gio
* .glox
* .gpd
* .gpg
* .gpn
* .gro
* .grob
* .grs
* .gsd
* .gthr
* .gtp
* .gv
* .gwi
* .gz
* .h
* .hbk
* .hdb
* .hdp
* .hdr
* .hht
* .his
* .hp
* .hpg
* .hpi
* .hs
* .htc
* .hwp
* .hz
* .ib
* .ibd
* .icn
* .icon
* .icpr
* .idc
* .idea
* .idx
* .igt
* .igx
* .ihx
* .ii
* .iiq
* .imd
* .info
* .ink
* .ipf
* .ipx
* .iso
* .itdb
* .itw
* .iwi
* .j
* .jar
* .jas
* .java
* .jbig
* .jbmp
* .jbr
* .jfif
* .jia
* .jis
* .jng
* .joe
* .jpe
* .jpeg
* .jpg
* .jps
* .jpx
* .jrtf
* .js
* .jsp
* .jtf
* .jtx
* .jw
* .jxr
* .kdb
* .kdbx
* .kdc
* .kdi
* .kdk
* .kes
* .ke
* .kic
* .klg
* .knt
* .kon
* .kpg
* .kwd
* .lay
* .lbm
* .lbt
* .ldf
* .lgc
* .lis
* .lit
* .ljp
* .lmk
* .lnt
* .lrc
* .lst
* .ltr
* .ltx
* .lue
* .luf
* .lwo
* .lwp
* .lws
* .lyt
* .lyx
* .ma
* .mac
* .man
* .map
* .maq
* .mat
* .max
* .mb
* .mbm
* .mbox
* .mdb
* .mdf
* .mdn
* .mdt
* .me
* .mef
* .mel
* .mft
* .mgcb
* .mgmf
* .mgmt
* .mgmx
* .mgtx
* .mid
* .min
* .mkv
* .mm
* .mmat
* .mnr
* .mnt
* .mos
* .mov
* .mpeg
* .mpf
* .mpg
* .mpo
* .mrg
* .mrxs
* .msg
* .mud
* .mwb
* .mwp
* .mx
* .my
* .myd
* .myi
* .ncr
* .nct
* .ndf
* .nef
* .nfo
* .njx
* .nlm
* .now
* .nrw
* .nsf
* .nyf
* .nzb
* .obj
* .oce
* .oci
* .ocr
* .odb
* .odg
* .odm
* .odo
* .odp
* .ods
* .odt
* .of
* .oft
* .omf
* .oplc
* .oqy
* .ora
* .orf
* .ort
* .orx
* .ost
* .ota
* .otg
* .oti
* .otp
* .ots
* .ott
* .ovp
* .ovr
* .owc
* .owg
* .oyx
* .ozb
* .ozj
* .ozt
* .p
* .pa
* .pan
* .pano
* .pap
* .paq
* .pas
* .pbm
* .pcd
* .pcs
* .pdb
* .pdd
* .pdf
* .pdm
* .pds
* .pdt
* .pef
* .pem
* .pff
* .pfi
* .pfs
* .pfv
* .pfx
* .pgf
* .pgm
* .phm
* .php
* .pic
* .pict
* .pix
* .pjpg
* .pjt
* .plt
* .pm
* .pmg
* .png
* .pni
* .pnm
* .pntg
* .pnz
* .pobj
* .pop
* .pot
* .potm
* .potx
* .ppam
* .ppm
* .pps
* .ppsm
* .ppsx
* .ppt
* .pptm
* .pptx
* .prt
* .prw
* .psd
* .psdx
* .pse
* .psid
* .psp
* .pst
* .psw
* .ptg
* .pth
* .ptx
* .pu
* .pvj
* .pvm
* .pvr
* .pwa
* .pwi
* .pwr
* .px
* .pxr
* .pza
* .pzp
* .pzs
* .qd
* .qmg
* .qpx
* .qry
* .qvd
* .rad
* .rar
* .ras
* .raw
* .rb
* .rctd
* .rcu
* .rd
* .rdb
* .rft
* .rgb
* .rgf
* .rib
* .ric
* .riff
* .ris
* .rix
* .rle
* .rli
* .rng
* .rpd
* .rpf
* .rpt
* .rri
* .rs
* .rsb
* .rsd
* .rsr
* .rst
* .rt
* .rtd
* .rtf
* .rtx
* .run
* .rw
* .rzk
* .rzn
* .saf
* .sam
* .sbf
* .scad
* .scc
* .sch
* .sci
* .scm
* .sct
* .scv
* .scw
* .sdb
* .sdf
* .sdm
* .sdoc
* .sdw
* .sep
* .sfc
* .sfw
* .sgm
* .sh
* .sig
* .skm
* .sla
* .sld
* .sldm
* .sldx
* .slk
* .sln
* .sls
* .smf
* .sms
* .snt
* .sob
* .spa
* .spe
* .sph
* .spj
* .spp
* .spq
* .spr
* .sq
* .sqb
* .srw
* .ssa
* .ssk
* .st
* .stc
* .std
* .sti
* .stm
* .stn
* .stp
* .str
* .stw
* .sty
* .sub
* .suo
* .svf
* .svg
* .svgz
* .swf
* .sxc
* .sxd
* .sxg
* .sxi
* .sxm
* .sxw
* .tab
* .tar
* .tbk
* .tcx
* .tdf
* .tdt
* .te
* .tex
* .text
* .tgz
* .thp
* .tif
* .tiff
* .tlb
* .tlc
* .tm
* .tmd
* .tmv
* .tmx
* .tne
* .tpc
* .trm
* .tvj
* .udb
* .ufr
* .unx
* .uof
* .uop
* .uot
* .upd
* .usr
* .utxt
* .vb
* .vbr
* .vbs
* .vcd
* .vct
* .vdb
* .vdi
* .vec
* .vm
* .vmdk
* .vmx
* .vnt
* .vob
* .vpd
* .vrm
* .vrp
* .vsd
* .vsdm
* .vsdx
* .vsm
* .vstm
* .vstx
* .vue
* .vw
* .wav
* .wbk
* .wcf
* .wdb
* .wgz
* .wire
* .wks
* .wma
* .wmdb
* .wmv
* .wn
* .wp
* .wpa
* .wpd
* .wpg
* .wps
* .wpt
* .wpw
* .wri
* .wsc
* .wsd
* .wsh
* .wtx
* .x
* .xar
* .xd
* .xdb
* .xlc
* .xld
* .xlf
* .xlgc
* .xlm
* .xls
* .xlsb
* .xlsm
* .xlsx
* .xlt
* .xltm
* .xltx
* .xlw
* .xps
* .xwp
* .xyp
* .xyw
* .ya
* .ybk
* .ym
* .zabw
* .zdb
* .zdc
* .zip
* .zw
The following diagrams detail the Magniber ransomware infection chains we
observed when malicious attackers exploit Internet Explorer, MSI installer, and
JS, JSE, and WSF installer vulnerabilities.
Figure 5. Magniber ransomware infection chain involving the Internet Explorer
Memory Corruption Vulnerability
Figure 6. Magniber ransomware infection chain involving MSI installer
Figure 7. Magniber infection chain involving JS, JSE, and WSF installers
MITRE TACTICS AND TECHNIQUES
Initial AccessExecutionDefense EvasionDiscoveryCommand and ControlImpactResource
Development
T1190 - Exploit Public-Facing Application
Has been observed to be exploiting the following vulnerabilities for initial
access:
• Magnitude exploit kit
• CVE-2016-0189
• CVE-2018-8174
• CVE-2019-1367
• Scripting Engine Memory Corruption Vulnerability (Internet Explorer)
• CVE-2020-0968
• Internet Explorer Memory Corruption Vulnerability
• CVE-2021-26411
• Remote code execution vulnerability in MSHTML (Internet Explorer)
• CVE-2021-40444
• PrintNightmare
• CVE-2021-34527
T1059.003 - Command and Scripting Interpreter: Windows Command Shell
Magniber uses cmd.exe to execute commands for execution.
T1047 - Windows Management Instrumentation
Magniber uses WMIC to delete shadow copies.
T1059.007 - Command and Scripting Interpreter: JavaScript
The new Magniber version is written in JSE/JS format and still tricks the user
by masquerading as a legitimate installer/Windows update.
T1204 - User Execution
New Magniber versions use ZIP attachments containing the malicious payload.
T1203 - Exploitation for Client Execution
Magniber bypasses MOTW exploiting the following vulnerability using fake digital
signatures:
• CVE-2022-44698
T1218.010 - Signed Binary Proxy Execution: Regsvr32
Magniber uses regsvr32.exe and scrobj.dll commands to execute its dropped TXT
file.
T1055.003 - Process Injection: Thread Execution Hijacking
Magniber injects into each process if the following criteria is met:
• The process is not
iexplore.exe
• Process integrity is less
than SYSTEM
• Process is not running in WoW64 environment (32-bit running in 64-bit OS)
T1140 - Deobfuscate/Decode Files or Information
The main payload and related strings are decrypted before execution.
T1112 - Modify Registry
Magniber modifies specific registries to execute shadow copy deletion.
T1218.007 - System Binary Proxy Execution: Msiexec
Recent Magniber infections leverage fake installers (.msi) by calling the
encrypted ransomware DLL through the CustomAction table.
T1218.002 - System Binary Proxy Execution: Control Panel
New Magniber variants use CPL file format to execute their malicious payload.
T1036.005 - Masquerading: Match Legitimate Name or Location
Magniber masquerades as an update for Windows or MS upgrades to trick the user
into executing the file.
T1620 - Reflective Code Loading
Magniber script variants are reflectively loaded in order to proceed with
execution.
T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass
Magniber uses a malformed digital signature block to bypass execution blocks by
MOTW.
T1083 - File and Directory Discovery
Magniber searches for files and directories for encryption.
T1135 - Network Share Discovery
Magniber encrypts files in network/remote drives.
T1057 - Process Discovery
Magniber uses NtQuerySystemInformation API to obtain running processes in the
machine.
T1082 - System Information Discover
Magniber gathers the computer name of the affected machine, as well as the build
number of the compromised windows operating system via the fixed offset
[DS]:7FFE026C
T1071.001 - Application Layer Protocol: Web Protocols
Magniber appends the data gathered form the machine when connecting to the URL
of the payment page.
T1490 - Inhibit System Recovery
Magniber then deletes volume shadow copies via WMIC and by modifying specific
registry entries.
T1486 - Data Encrypted for Impact
It avoids encrypting files with the following folders:
• documents and
settings
• appdata
• local settings
• sample music
• sample pictures
• sample videos
• tor browser
• recycle
• windows
• boot
• intel
• msocache
• perflogs
• program files
• programdata
• recovery
• system volume
information
• winnt
Magniber also avoids encrypting the following files with file attributes:
• FILE_ATTRIBUTE_SYSTEM
• FILE_ATTRIBUTE_HIDDEN
• FILE_ATTRIBUTE_
READYONLY
• FILE_ATTRIBUTE_
TEMPORARY
• FILE_ATTRIBUTE_
VIRTUAL
It avoids encrypting the following folders with file attributes:
• FILE_ATTRIBUTE_
SYSTEM
• FILE_ATTRIBUTE_HIDDEN
• FILE_ATTRIBUTE_
ENCRYPTED
Magniber also avoids encrypting files with the following attributes:
• FILE_ATTRIBUTE_SYSTEM
• FILE_ATTRIBUTE_HIDDEN
• FILE_ATTRIBUTE_
READYONLY
• FILE_ATTRIBUTE_
TEMPORARY
• FILE_ATTRIBUTE_
VIRTUAL
Magniber initially encrypts target files via symmetric AES, then encrypts the
AES symmetric key and IV via RSA using CryptoAPIs. It encrypts equal-size data
blocks (1,048,576 bytes) per iteration until the final block is encrypted.
It appends the mutex name as its appended extension.
T1608.005 - Stage Capabilities: Link Target
Magniber uses typosquatting to trick users into accessing the malicious payload.
SUMMARY OF MALWARE, TOOLS, AND EXPLOITS USED
Security teams must take not of and be on the lookout for the following tools
and exploits typically used in Magniber ransomware attacks:
Exploits
* CVE-2016-0189
* CVE-2018-8174
* CVE-2019-1367
* CVE-2020-0968
* CVE-2021-26411
* CVE-2021-40444
* CVE-2021-34527
* CVE-2022-44698
Tools
* WMI
Malware
* Fodscript
Initial AccessExecutionDefense EvasionPrivilege EscalationImpact
* CVE-2016-0189
* WMI
* Fodscript
* Fodscript
* Magniber ransomware
* CVE-2018-8174
* CVE-2022-44698
* CVE-2019-1367
* CVE-2020-0968
* CVE-2021-26411
* CVE-2021-40444
* CVE-2021-34527
RECOMMENDATIONS
Given its continued activity in 2022, we can expect to see more of the Magniber
ransomware in the future. As attackers continue to find ways to distribute its
payloads and circumvent security warnings, organizations and their members must
remain vigilant to prevent being compromised. We encourage organizations to
remain on the lookout for the Magniber ransomware and continue monitoring its
evolution to minimize the possibility of a successful attack.
To protect systems against the Magniber ransomware and other similar threats,
organizations can implement security frameworks that allocate resources
systematically to establish a strong defense strategy.
Here are some best practices that organizations can consider to help protect
themselves from the Magniber ransomware infection:
AUDIT AND INVENTORY
* Take an inventory of assets and data.
* Identify authorized and unauthorized devices and software.
* Audit event and incident logs.
CONFIGURE AND MONITOR
* Manage hardware and software configurations.
* Grant admin privileges and access only when necessary to an employee’s role.
* Monitor network ports, protocols, and services.
* Activate security configurations on network infrastructure devices such as
firewalls and routers.
* Establish a software allowlist that only executes legitimate applications.
PATCH AND UPDATE
* Conduct regular vulnerability assessments.
* Perform patching or virtual patching for operating systems and applications.
* Update software and applications to their latest versions.
PROTECT AND RECOVER
* Implement data protection, back up, and recovery measures.
* Enable multifactor authentication (MFA).
SECURE AND DEFEND
* Employ sandbox analysis to block malicious emails.
* Deploy the latest versions of security solutions to all layers of the system,
including email, endpoint, web, and network.
* Discover early signs of an attack, such as the presence of suspicious tools
in the system.
* Use advanced detection technologies such as those powered by AI and machine
learning.
TRAIN AND TEST
* Regularly train and assess employees on security skills.
* Conduct red-team exercises and penetration tests.
A multilayered approach can help organizations guard possible entry points into
the system (endpoint, email, web, and network). Security solutions that can
detect malicious components and suspicious behavior can also help protect
enterprises.
* Trend Micro Vision One™ provides multilayered protection and behavior
detection, which helps block questionable behavior and tools early on before
the ransomware can do irreversible damage to the system.
* Trend Micro Cloud One™ - Workload Security protects systems against both
known and unknown threats that exploit vulnerabilities. This protection is
made possible through techniques such as virtual patching and machine
learning.
* Trend Micro™ Deep Discovery™ Email Inspector employs custom sandboxing and
advanced analysis techniques to effectively block malicious emails, including
phishing emails that can serve as entry points for ransomware.
* Trend Micro Apex One™ offers next-level automated threat detection and
response against advanced concerns such as fileless threats and ransomware,
ensuring the protection of endpoints.
INDICATORS OF COMPROMISE (IOCS)
The IOCs for this article can be found here. Actual indicators might vary per
attack.
HIDE
Like it? Add this infographic to your site:
1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to
copy. 4. Paste the code into your page (Ctrl+V).
Image will appear the same size as you see above.
Posted in Ransomware Spotlight, Ransomware
RELATED POSTS
* Calibrating Expansion: 2023 Annual Cybersecurity Report
* Ransomware Spotlight: LockBit
* Trend Micro Security Predictions for 2024: Critical Scalability
* Ransomware Spotlight: Trigona
* Ransomware Spotlight: Akira
RECENT POSTS
* Apache APISIX In-the-wild Exploitations: An API Gateway Security Study
* Calibrating Expansion: 2023 Annual Cybersecurity Report
* Ransomware Spotlight: Rhysida
* Ransomware Spotlight: LockBit
* Building Resilience: 2024 Security Predictions for the Cloud
WE RECOMMEND
* Internet of Things
* Virtualization & Cloud
* Ransomware
* Security Technology
* MQTT and M2M: Do You Know Who Owns Your Machine’s Data?
* Addressing CAPTCHA-Evading Phishing Threats With Behavior-Based AI
Protection
* A Deep Dive into the Packet Reflection Vulnerability Allowing Attackers to
Plague Private 5G Networks
* Building Resilience: 2024 Security Predictions for the Cloud
* Enhancing Software Supply-Chain Security: Navigating SLSA Standards and
the MITRE ATT&CK Framework
* Understanding the Kubernetes Security Triad: Image Scanning, Admission
Controllers, and Runtime Security
* Calibrating Expansion: 2023 Annual Cybersecurity Report
* Ransomware Spotlight: LockBit
* Trend Micro Security Predictions for 2024: Critical Scalability
* Post-Quantum Cryptography: Quantum Computing Attacks on Classical
Cryptography
* Diving Deep Into Quantum Computing: Computing With Quantum Mechanics
* Distributed Energy Generation Gateway (In)Security
CRITICAL SCALABILITY: TREND MICRO SECURITY PREDICTIONS FOR 2024
View the 2024 Trend Micro Security Predictions
CALIBRATING EXPANSION: 2023 ANNUAL CYBERSECURITY REPORT
View the report
Try our services free for 30 days
* Start your free trial today
*
*
*
*
*
RESOURCES
* Blog
* Newsroom
* Threat Reports
* DevOps Resource Center
* CISO Resource Center
* Find a Partner
SUPPORT
* Business Support Portal
* Contact Us
* Downloads
* Free Trials
*
*
ABOUT TREND
* About Us
* Careers
* Locations
* Upcoming Events
* Trust Center
*
COUNTRY HEADQUARTERS
Trend Micro - United States (US)
225 East John Carpenter Freeway
Suite 1500
Irving, Texas 75062
Phone: +1 (817) 569-8900
Select a country / region
United States expand_more
close
THE AMERICAS
* United States
* Brasil
* Canada
* México
MIDDLE EAST & AFRICA
* South Africa
* Middle East and North Africa
EUROPE
* België (Belgium)
* Česká Republika
* Danmark
* Deutschland, Österreich Schweiz
* España
* France
* Ireland
* Italia
* Nederland
* Norge (Norway)
* Polska (Poland)
* Suomi (Finland)
* Sverige (Sweden)
* Türkiye (Turkey)
* United Kingdom
ASIA & PACIFIC
* Australia
* Центральная Азия (Central Asia)
* Hong Kong (English)
* 香港 (中文) (Hong Kong)
* भारत गणराज्य (India)
* Indonesia
* 日本 (Japan)
* 대한민국 (South Korea)
* Malaysia
* Монголия (Mongolia) and рузия (Georgia)
* New Zealand
* Philippines
* Singapore
* 台灣 (Taiwan)
* ประเทศไทย (Thailand)
* Việt Nam
Privacy | Legal | Accessibility | Site map
Copyright ©2024 Trend Micro Incorporated. All rights reserved
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word word word word word word word word word
word word word word word word word word
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1
mmMwWLliI0fiflO&1