www.trendmicro.com
Open in
urlscan Pro
2.16.96.166
Public Scan
Submitted URL: http://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-magniber
Effective URL: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-magniber
Submission: On March 22 via api from DE — Scanned from DE
Effective URL: https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-magniber
Submission: On March 22 via api from DE — Scanned from DE
Form analysis
1 forms found in the DOM<form class="main-menu-search" aria-label="Search Trend Micro" data-equally-id="equally_ai___YNbex">
<div class="main-menu-search__field-wrapper" id="cludo-search-form">
<table class="gsc-search-box">
<tbody>
<tr>
<td class="gsc-input">
<input type="text" class="gsc-input-field" name="search" title="search" placeholder="Search" autocomplete="off" aria-label="search">
</td>
</tr>
</tbody>
</table>
</div>
</form>
Text Content
Business search close * Solutions * By Challenge * By Challenge * By Challenge Learn more * Understand, Prioritize & Mitigate Risks * Understand, Prioritize & Mitigate Risks Improve your risk posture with attack surface management Learn more * Protect Cloud-Native Apps * Protect Cloud-Native Apps Security that enables business outcomes Learn more * Protect Your Hybrid World * Protect Your Hybrid, Multi-Cloud World Gain visibility and meet business needs with security Learn more * Securing Your Borderless Workforce * Securing Your Borderless Workforce Connect with confidence from anywhere, on any device Learn more * Eliminate Network Blind Spots * Eliminate Network Blind Spots Secure users and key operations throughout your environment Learn more * See More. Respond Faster. * See More. Respond Faster. Move faster than your adversaries with powerful purpose-built XDR, attack surface risk management, and zero trust capabilities Learn more * Extend Your Team * Extend Your Team. Respond to Threats Agilely Maximize effectiveness with proactive risk reduction and managed services Learn more * Operationalizing Zero Trust * Operationalizing Zero Trust Understand your attack surface, assess your risk in real time, and adjust policies across network, workloads, and devices from a single console Learn more * By Role * By Role * By Role Learn more * CISO * CISO Drive business value with measurable cybersecurity outcomes Learn more * SOC Manager * SOC Manager See more, act faster Learn more * Infrastructure Manager * Infrastructure Manager Evolve your security to mitigate threats quickly and effectively Learn more * Cloud Builder and Developer * Cloud Builder and Developer Ensure code runs only as intended Learn more * Cloud Security Ops * Cloud Security Ops Gain visibility and control with security designed for cloud environments Learn more * By Industry * By Industry * By Industry Learn more * Healthcare * Healthcare Protect patient data, devices, and networks while meeting regulations Learn more * Manufacturing * Manufacturing Protecting your factory environments – from traditional devices to state-of-the-art infrastructures Learn more * Oil & Gas * Oil & Gas ICS/OT Security for the oil and gas utility industry Learn more * Electric Utility * Electric Utility ICS/OT Security for the electric utility Learn more * Federal * Federal Learn more * Automotive * Automotive Learn more * 5G Networks * 5G Networks Learn more * Small & Midsized Business Security * Small & Midsized Business Security Stop threats with comprehensive, set-it-and-forget-it protection Learn more * Platform * Vision One Platform * Vision One Platform * Trend Vision One Our Unified Platform Bridge threat protection and cyber risk management Learn more * AI Companion * Trend Vision One Companion Your generative AI cybersecurity assistant Learn more * Attack Surface Management * Attack Surface Management Stop breaches before they happen Learn more * XDR (Extended Detection & Response) * XDR (Extended Detection & Response) Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Cloud Security * Cloud Security * Trend Vision One™ Cloud Security Overview The most trusted cloud security platform for developers, security teams, and businesses Learn more * Attack Surface Risk Management for Cloud * Attack Surface Risk Management for Cloud Cloud asset discovery, vulnerability prioritization, Cloud Security Posture Management, and Attack Surface Management all in one Learn more * XDR for Cloud * XDR for Cloud Extend visibility to the cloud and streamline SOC investigations Learn more * Workload Security * Workload Security Secure your data center, cloud, and containers without compromising performance by leveraging a cloud security platform with CNAPP capabilities Learn more * Container Security * Container Security Simplify security for your cloud-native applications with advanced container image scanning, policy-based admission control, and container runtime protection Learn more * File Storage Security * File Storage Security Security for cloud file/object storage services leveraging cloud-native application architectures Learn more * Endpoint Security * Endpoint Security * Endpoint Security Overview Defend the endpoint through every stage of an attack Learn more * XDR for Endpoint * XDR for Endpoint Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Workload Security * Workload Security Optimized prevention, detection, and response for endpoints, servers, and cloud workloads Learn more * Industrial Endpoint Security * Industrial Endpoint Security Learn more * Mobile Security * Mobile Security On-premises and cloud protection against malware, malicious applications, and other mobile threats Learn more * Network Security * Network Security * Network Security Overview Expand the power of XDR with network detection and response Learn more * XDR for Network * XDR for Network Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Network Intrusion Prevention (IPS) * Network Intrusion Prevention (IPS) Protect against known, unknown, and undisclosed vulnerabilities in your network Learn more * Breach Detection System (BDS) * Breach Detection System (BDS) Detect and respond to targeted attacks moving inbound, outbound, and laterally Learn more * Secure Service Edge (SSE) * Secure Service Edge (SSE) Redefine trust and secure digital transformation with continuous risk assessments Learn more * Industrial Network Security * Industrial Network Security Learn more * 5G Network Security * 5G Network Security Learn more * Email Security * Email Security * Email Security Stop phishing, malware, ransomware, fraud, and targeted attacks from infiltrating your enterprise Learn more * Email and Collaboration Security * Trend Vision One™ Email and Collaboration Security Stop phishing, ransomware, and targeted attacks on any email service including Microsoft 365 and Google Workspace Learn more * OT Security * OT Security * OT Security Learn about solutions for ICS / OT security. Learn more * XDR for OT * XDR for OT Stop adversaries faster with a broader perspective and better context to hunt, detect, investigate, and respond to threats from a single platform Learn more * Industrial Network Security * Industrial Network Security Industrial Network Security * Industrial Endpoint Security * Industrial Endpoint Security Learn more * Threat Intelligence * Threat Intelligence Keep ahead of the latest threats and protect your critical data with ongoing threat prevention and analysis Learn more * All Products, Services, and Trials * All Products, Services, and Trials Learn more * Research * Research * Research * Research Learn more * Research, News, and Perspectives * Research, News, and Perspectives Learn more * Research and Analysis * Research and Analysis Learn more * Security News * Security News Learn more * Zero Day Initiatives (ZDI) * Zero Day Initiatives (ZDI) Learn more * Services * Our Services * Our Services * Our Services Learn more * Service Packages * Service Packages Augment security teams with 24/7/365 managed detection, response, and support Learn more * Managed XDR * Managed XDR Augment threat detection with expertly managed detection and response (MDR) for email, endpoints, servers, cloud workloads, and networks Learn more * Incident Response * Incident Response * Incident Response Our trusted experts are on call whether you're experiencing a breach or looking to proactively improve your IR plans Learn more * Insurance Carriers and Law Firms * Insurance Carriers and Law Firms Stop breaches with the best response and detection technology on the market and reduce clients’ downtime and claim costs Learn more * Support Services * Support Services Learn more * Partners * Partner Program * Partner Program * Partner Program Overview Grow your business and protect your customers with the best-in-class complete, multilayered security Learn more * Managed Security Service Provider * Managed Security Service Provider Deliver modern security operations services with our industry-leading XDR Learn more * Managed Service Provider * Managed Service Provider Partner with a leading expert in cybersecurity, leverage proven solutions designed for MSPs Learn more * Cloud Service Provider * Cloud Service Provider Add market-leading security to your cloud service offerings – no matter which platform you use Learn more * Professional Services * Professional Services Increase revenue with industry-leading security Learn more * Resellers * Resellers Discover the possibilities Learn more * Marketplace * Marketplace Learn more * System Integrators * System Integrators Learn more * Alliance Partners * Alliance Partners * Alliance Overview We work with the best to help you optimize performance and value Learn more * Technology Alliance Partners * Technology Alliance Partners Learn more * Our Alliance Partners * Our Alliance Partners Learn more * Partner Tools * Partner Tools * Partner Tools Learn more * Partner Login * Partner Login Login * Education and Certification * Education and Certification Learn more * Partner Successes * Partner Successes Learn more * Distributors * Distributors Learn more * Find a Partner * Find a Partner Learn more * Company * Why Trend Micro * Why Trend Micro * Why Trend Micro Learn more * Customer Success Stories * Customer Success Stories Learn more * The Human Connection * The Human Connection Learn more * Industry Accolades * Industry Accolades Learn more * Strategic Alliances * Strategic Alliances Learn more * Compare Trend Micro * Compare Trend Micro Learn more * About Us * About Us * About Us Learn more * Trust Center * Trust Center Learn more * History * History Learn more * Diversity, Equity and Inclusion * Diversity, Equity and Inclusion Learn more * Corporate Social Responsibility * Corporate Social Responsibility Learn more * Leadership * Leadership Learn more * Security Experts * Security Experts Learn more * Internet Safety and Cybersecurity Education * Internet Safety and Cybersecurity Education Learn more * Legal * Legal Learn more * Investors * Investors Learn more * Formula E Racing * Formula E Racing Learn more * Latest News * Latest News * Latest News Learn more * Newsroom * Newsroom Learn more * Events * Events Learn more * Careers * Careers Learn more * Webinars * Webinars Learn more Back Back Back Back * Free Trials * Contact Us Looking for home solutions? Under Attack? Support * Business Support Portal * Business Community * Virus and Threat Help * Education and Certification * Contact Support * Find a Support Partner Resources * Cyber Risk Index/Assessment * CISO Resource Center * DevOps Resource Center * What Is? * Threat Encyclopedia * Cloud Health Assessment * Cyber Insurance * Glossary of Terms * Webinars Log In * Support * Partner Portal * Cloud One * Product Activation and Management * Referral Affililate Back arrow_back search close * Security News * Ransomware Spotlight * Ransomware Spotlight: Magniber RANSOMWARE SPOTLIGHT: MAGNIBER X Magniber January 26, 2023 * Email * Facebook * Twitter * Google+ * Linkedin By Trend Micro Research The Magniber ransomware initially targeted only Asian countries when it was first detected in 2017. However, it resurfaced in 2021 and continues to operate today with expanded targets around the globe. Magniber remains a significant player in the threat landscape, with malicious attackers likely to continue using the ransomware in future. View infographic of "Ransomware Spotlight: Magniber" Despite first being detected six years ago, malicious attackers continue to use the Magniber ransomware to compromise organizations. In October 2022, phishing attacks were reported to distribute the Magniber ransomware using standalone JavaScript files digitally signed with a malformed key, exploiting the zero-day vulnerability CVE-2022-44698 to bypass Mark-of-the-Web (MOTW) security warnings, and allowing malicious files to be executed without raising alerts. Microsoft later patched this vulnerability in December 2022. Formerly known as a successor of Cerber, the Magniber ransomware was primarily distributed via the Magnitude exploit kit and exclusively targeted South Korea in 2017. In 2018, it expanded its targets across Asia using CVE-2018-8174 for initial access. WHAT ORGANIZATIONS NEED TO KNOW ABOUT THE MAGNIBER RANSOMWARE After its initial discovery in 2017, Magniber resurfaced in 2021. Although it still targeted Asian countries, we found it exploiting new vulnerabilities for initial access, including CVE-2021-26411, CVE-2021-40444, and most notably the PrintNightmare vulnerability, CVE-2021-34527. As of writing, there are no known leak sites related to Magniber, which follows the ransomware-as-aservice (RaaS) business model but is not involved in the more talked-about and recent double-extortion ransomware campaigns. Magniber was also previously known to use typosquatting, a technique that involves using domains similar to legitimate websites to lure users into downloading a ransomware payload. We also observed Magniber distributing itself through fake installers with APPX and MSI formats in the first quarter of 2022. Attackers use the MSI CustomAction table to execute the Magniber ransomware by calling the export of the malicious DLL in the MSI package. The installer additionally drops the malicious binary file we detected as Fodscript, a piece of malware used for privileged escalation. Fodscript drops two script files: The first modifies the registry entries checked in by fodhelper.exe to manipulate it into executing the second script with high privilege. Afterward, it bypasses User Account Control (UAC) to delete volume shadow copies in the compromised machine. We also observed Magniber posing as fake installers and Windows updates to lure users into selecting the malicious payload. Additionally, we observed that Magniber recently incorporated malformed digital signatures to bypass execution blocks by MOTW, thus allowing easy installation of the ransomware payload. Though we have yet to encounter this tactic in cases we detected, the group behind Magniber was observed as using the COVID-19 surge in the last months of 2022 to distribute its payloads through COVID-19 file lures, alongside its aforementioned tactics. Magniber was also recently found bypassing MOTW and exploiting CVE-2022-44698 using a fake digital signature. TOP AFFECTED COUNTRIES AND INDUSTRIES ACCORDING TO TREND MICRO DATA In this section, we examine the Magniber ransomware’s attempts to compromise organizations in 2022 based on Trend Micro™ Smart Protection Network™ country and regional data. It’s important to note that this data covers only Trend Micro customers and does not contain all victims of Magniber. Malicious attackers behind Magniber started slow in 2022, with less than 20 attacks per month in the first quarter of the year. The attack attempts steadily increased as the year progressed, with attackers making the most of September 2022, which recorded the largest number of attack attempts at 1,482 detections. Attack attempts diminished during the last quarter of the year but remained high with 508 detections in December. The following figure details the total number of attempted attacks by Magniber in 2022. Figure 1. A monthly breakdown of Magniber attack attempts in terms of infected machines in 2022 Source: Trend Micro™ Smart Protection Network™ -------------------------------------------------------------------------------- The highest number of Magniber attacks was detected in Taiwan with a total of 204 attack attempts, which makes up most of the attack attempt detections at approximately 76.1% of the total. South Korea, initially targeted by Magniber when it was first detected, has the second most attack attempts with a large margin at 15, followed by Australia with nine. Turkey and Japan follow with six detections each. Our data shows that Magniber has expanded its targets beyond Asian countries. Note that the data in Figure 2 is limited to feedback provided by customers, majority of whom preferred not to disclose their locations. Figure 2. The top 10 countries with the highest number of attack attempts in terms of infected machines for the Magniber ransomware (Jan. 1, 2022 to Dec. 31, 2022) Source: Trend Micro Smart Protection Network -------------------------------------------------------------------------------- Industry data, on the other hand, showed that educational organizations, the government, and manufacturing industries experienced the largest number of Magniber ransomware attack attempts, followed by the healthcare and technology industries. Other industries that experienced less attempted attacks were the energy, transportation, and real estate industries. In total, there were 987 total detections of Magniber attack attempts across industries in 2022 from customer feedback detailing the industries in which they belong. Figure 3. An industry breakdown of Magniber ransomware attack attempts in terms of infected machines (Jan. 1, 2022 to Dec. 31, 2022) Source: Trend Micro Smart Protection Network INFECTION CHAIN AND TECHNIQUES We found that the Magniber ransomware exploits different vulnerabilities, but while it uses a more straightforward kill chain compared to the newer double-extortion ransomware campaigns, its simplicity does not make it any less effective. The following figure details various vulnerabilities exploited to deliver its payload: Figure 4. Vulnerabilities exploited to deliver Magniber ransomware INITIAL ACCESS * Magniber threat actors leverage different vulnerabilities for initial access such as the aforementioned Magnitude exploit kit (CVE-2016-0189, CVE-2018-8174, and CVE-2019-1367), the Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2020-0968), the Internet Explorer Memory Corruption Vulnerability (CVE-2021-26411), the Internet Explorer remote code execution (RCE) vulnerability in MSHTML (CVE-2021-40444), and PrintNightmare (CVE-2021-34527). COMMAND AND CONTROL * Magniber has the capability to send collected information to its command and control (C&C) and the payment browser. DEFENSE EVASION * Magniber injects itself to all processes except iexplore.exe and excluding system and processes not running in a WoW64 environment. The ransomware uses NtQuerySystemInformation API to obtain running processes in the machine. * Recent Magniber infections leverage fake installers (.msi) by calling the encrypted ransomware DLL through the CustomAction table, as well as the CPL file format to execute its payload. * Magniber uses a malformed digital signature block to bypass execution blocks by MOTW. Recently, it was found exploiting CVE-2022-44698 to bypass MOTW with a fake digital signature. * It uses a file detected as Fodscript that drops a script file to delete shadow copies from the target machine. DISCOVERY * Magniber uses NtQuerySystemInformation API to obtain running processes in the machine. * It searches for specific files, folders, and attributes and encrypts them if they match its specified criteria. PRIVILEGE ESCALATION * Magniber uses a file detected as Fodscript that drops two script files: One of the script files modifies the registry entries that fodhelper.exe checks in order to manipulate fodhelper.exe into executing the second script with high privilege and bypassing UAC. COLLECTION, EXFILTRATION * As of now, there are no data exfiltration and leaks being done by Magniber. IMPACT * The final ransomware binary would then be deployed, thereby ensuring that files are encrypted in the machine. It also ensures that shadow copies are deleted to inhibit system recovery. * It initially encrypts target files via symmetric AES, then encrypts the AES symmetric key and IV via RSA using CryptoAPIs. It encrypts equal-size data blocks (1,048,576 bytes) per iteration until the final block is encrypted. * It appends the mutex name as its appended extension. * It can also delete shadow copies in the infected machine. OTHER TECHNICAL DETAILS * Magniber encrypts files with the following extensions: * .abm * .abs * .abw * .accdb * .act * .adn * .adp * .aes * .aft * .afx * .agif * .agp * .ahd * .ai * .aic * .aim * .albm * .alf * .ans * .apd * .apm * .apng * .aps * .apt * .apx * .arc * .art * .arw * .asc * .ase * .asf * .ask * .asm * .asp * .asw * .asy * .aty * .avi * .awdb * .awp * .awt * .aww * .azz * .bad * .bak * .bay * .bbs * .bdb * .bdp * .bdr * .bean * .bib * .bmp * .bmx * .bna * .bnd * .boc * .bok * .brd * .brk * .brn * .brt * .bss * .btd * .bti * .btr * .c * .ca * .cals * .can * .cd * .cdb * .cdc * .cdg * .cdmm * .cdmt * .cdmz * .cdr * .cdt * .cf * .cfu * .cgm * .cimg * .cin * .cit * .ckp * .class * .clkw * .cma * .cmx * .cnm * .cnv * .colz * .cpc * .cpd * .cpg * .cpp * .cps * .cpx * .crd * .crt * .crw * .cs * .csr * .csv * .csy * .ct * .cvg * .cvi * .cvs * .cvx * .cwt * .cxf * .cyi * .dad * .daf * .db * .dbc * .dbf * .dbk * .dbs * .dbt * .dbv * .dbx * .dca * .dcb * .dch * .dcr * .dcs * .dct * .dcx * .dd * .dds * .ded * .der * .dgn * .dgs * .dgt * .dhs * .dib * .dif * .dip * .diz * .djv * .djvu * .dmi * .dmo * .dnc * .dne * .doc * .docb * .docm * .docx * .docz * .dot * .dotm * .dotx * .dpp * .dpx * .dqy * .drw * .drz * .dsk * .dsn * .dsv * .dt * .dta * .dtsx * .dtw * .dv * .dvi * .dwg * .dx * .dxb * .dxf * .eco * .ecw * .ecx * .edb * .efd * .egc * .eio * .eip * .eit * .em * .emd * .emf * .emlx * .ep * .epf * .epp * .eps * .epsf * .eq * .erf * .err * .etf * .etx * .euc * .exr * .fa * .faq * .fax * .fb * .fbx * .fcd * .fcf * .fdf * .fdr * .fds * .fdt * .fdx * .fdxt * .fes * .fft * .fi * .fic * .fid * .fif * .fig * .fla * .flr * .flv * .fmv * .fo * .fodt * .fpos * .fpt * .fpx * .frm * .frt * .frx * .ftn * .fwdn * .fxc * .fxg * .fzb * .fzv * .gcdp * .gdb * .gdoc * .gem * .geo * .gfb * .gfie * .ggr * .gif * .gih * .gim * .gio * .glox * .gpd * .gpg * .gpn * .gro * .grob * .grs * .gsd * .gthr * .gtp * .gv * .gwi * .gz * .h * .hbk * .hdb * .hdp * .hdr * .hht * .his * .hp * .hpg * .hpi * .hs * .htc * .hwp * .hz * .ib * .ibd * .icn * .icon * .icpr * .idc * .idea * .idx * .igt * .igx * .ihx * .ii * .iiq * .imd * .info * .ink * .ipf * .ipx * .iso * .itdb * .itw * .iwi * .j * .jar * .jas * .java * .jbig * .jbmp * .jbr * .jfif * .jia * .jis * .jng * .joe * .jpe * .jpeg * .jpg * .jps * .jpx * .jrtf * .js * .jsp * .jtf * .jtx * .jw * .jxr * .kdb * .kdbx * .kdc * .kdi * .kdk * .kes * .ke * .kic * .klg * .knt * .kon * .kpg * .kwd * .lay * .lbm * .lbt * .ldf * .lgc * .lis * .lit * .ljp * .lmk * .lnt * .lrc * .lst * .ltr * .ltx * .lue * .luf * .lwo * .lwp * .lws * .lyt * .lyx * .ma * .mac * .man * .map * .maq * .mat * .max * .mb * .mbm * .mbox * .mdb * .mdf * .mdn * .mdt * .me * .mef * .mel * .mft * .mgcb * .mgmf * .mgmt * .mgmx * .mgtx * .mid * .min * .mkv * .mm * .mmat * .mnr * .mnt * .mos * .mov * .mpeg * .mpf * .mpg * .mpo * .mrg * .mrxs * .msg * .mud * .mwb * .mwp * .mx * .my * .myd * .myi * .ncr * .nct * .ndf * .nef * .nfo * .njx * .nlm * .now * .nrw * .nsf * .nyf * .nzb * .obj * .oce * .oci * .ocr * .odb * .odg * .odm * .odo * .odp * .ods * .odt * .of * .oft * .omf * .oplc * .oqy * .ora * .orf * .ort * .orx * .ost * .ota * .otg * .oti * .otp * .ots * .ott * .ovp * .ovr * .owc * .owg * .oyx * .ozb * .ozj * .ozt * .p * .pa * .pan * .pano * .pap * .paq * .pas * .pbm * .pcd * .pcs * .pdb * .pdd * .pdf * .pdm * .pds * .pdt * .pef * .pem * .pff * .pfi * .pfs * .pfv * .pfx * .pgf * .pgm * .phm * .php * .pic * .pict * .pix * .pjpg * .pjt * .plt * .pm * .pmg * .png * .pni * .pnm * .pntg * .pnz * .pobj * .pop * .pot * .potm * .potx * .ppam * .ppm * .pps * .ppsm * .ppsx * .ppt * .pptm * .pptx * .prt * .prw * .psd * .psdx * .pse * .psid * .psp * .pst * .psw * .ptg * .pth * .ptx * .pu * .pvj * .pvm * .pvr * .pwa * .pwi * .pwr * .px * .pxr * .pza * .pzp * .pzs * .qd * .qmg * .qpx * .qry * .qvd * .rad * .rar * .ras * .raw * .rb * .rctd * .rcu * .rd * .rdb * .rft * .rgb * .rgf * .rib * .ric * .riff * .ris * .rix * .rle * .rli * .rng * .rpd * .rpf * .rpt * .rri * .rs * .rsb * .rsd * .rsr * .rst * .rt * .rtd * .rtf * .rtx * .run * .rw * .rzk * .rzn * .saf * .sam * .sbf * .scad * .scc * .sch * .sci * .scm * .sct * .scv * .scw * .sdb * .sdf * .sdm * .sdoc * .sdw * .sep * .sfc * .sfw * .sgm * .sh * .sig * .skm * .sla * .sld * .sldm * .sldx * .slk * .sln * .sls * .smf * .sms * .snt * .sob * .spa * .spe * .sph * .spj * .spp * .spq * .spr * .sq * .sqb * .srw * .ssa * .ssk * .st * .stc * .std * .sti * .stm * .stn * .stp * .str * .stw * .sty * .sub * .suo * .svf * .svg * .svgz * .swf * .sxc * .sxd * .sxg * .sxi * .sxm * .sxw * .tab * .tar * .tbk * .tcx * .tdf * .tdt * .te * .tex * .text * .tgz * .thp * .tif * .tiff * .tlb * .tlc * .tm * .tmd * .tmv * .tmx * .tne * .tpc * .trm * .tvj * .udb * .ufr * .unx * .uof * .uop * .uot * .upd * .usr * .utxt * .vb * .vbr * .vbs * .vcd * .vct * .vdb * .vdi * .vec * .vm * .vmdk * .vmx * .vnt * .vob * .vpd * .vrm * .vrp * .vsd * .vsdm * .vsdx * .vsm * .vstm * .vstx * .vue * .vw * .wav * .wbk * .wcf * .wdb * .wgz * .wire * .wks * .wma * .wmdb * .wmv * .wn * .wp * .wpa * .wpd * .wpg * .wps * .wpt * .wpw * .wri * .wsc * .wsd * .wsh * .wtx * .x * .xar * .xd * .xdb * .xlc * .xld * .xlf * .xlgc * .xlm * .xls * .xlsb * .xlsm * .xlsx * .xlt * .xltm * .xltx * .xlw * .xps * .xwp * .xyp * .xyw * .ya * .ybk * .ym * .zabw * .zdb * .zdc * .zip * .zw The following diagrams detail the Magniber ransomware infection chains we observed when malicious attackers exploit Internet Explorer, MSI installer, and JS, JSE, and WSF installer vulnerabilities. Figure 5. Magniber ransomware infection chain involving the Internet Explorer Memory Corruption Vulnerability Figure 6. Magniber ransomware infection chain involving MSI installer Figure 7. Magniber infection chain involving JS, JSE, and WSF installers MITRE TACTICS AND TECHNIQUES Initial AccessExecutionDefense EvasionDiscoveryCommand and ControlImpactResource Development T1190 - Exploit Public-Facing Application Has been observed to be exploiting the following vulnerabilities for initial access: • Magnitude exploit kit • CVE-2016-0189 • CVE-2018-8174 • CVE-2019-1367 • Scripting Engine Memory Corruption Vulnerability (Internet Explorer) • CVE-2020-0968 • Internet Explorer Memory Corruption Vulnerability • CVE-2021-26411 • Remote code execution vulnerability in MSHTML (Internet Explorer) • CVE-2021-40444 • PrintNightmare • CVE-2021-34527 T1059.003 - Command and Scripting Interpreter: Windows Command Shell Magniber uses cmd.exe to execute commands for execution. T1047 - Windows Management Instrumentation Magniber uses WMIC to delete shadow copies. T1059.007 - Command and Scripting Interpreter: JavaScript The new Magniber version is written in JSE/JS format and still tricks the user by masquerading as a legitimate installer/Windows update. T1204 - User Execution New Magniber versions use ZIP attachments containing the malicious payload. T1203 - Exploitation for Client Execution Magniber bypasses MOTW exploiting the following vulnerability using fake digital signatures: • CVE-2022-44698 T1218.010 - Signed Binary Proxy Execution: Regsvr32 Magniber uses regsvr32.exe and scrobj.dll commands to execute its dropped TXT file. T1055.003 - Process Injection: Thread Execution Hijacking Magniber injects into each process if the following criteria is met: • The process is not iexplore.exe • Process integrity is less than SYSTEM • Process is not running in WoW64 environment (32-bit running in 64-bit OS) T1140 - Deobfuscate/Decode Files or Information The main payload and related strings are decrypted before execution. T1112 - Modify Registry Magniber modifies specific registries to execute shadow copy deletion. T1218.007 - System Binary Proxy Execution: Msiexec Recent Magniber infections leverage fake installers (.msi) by calling the encrypted ransomware DLL through the CustomAction table. T1218.002 - System Binary Proxy Execution: Control Panel New Magniber variants use CPL file format to execute their malicious payload. T1036.005 - Masquerading: Match Legitimate Name or Location Magniber masquerades as an update for Windows or MS upgrades to trick the user into executing the file. T1620 - Reflective Code Loading Magniber script variants are reflectively loaded in order to proceed with execution. T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass Magniber uses a malformed digital signature block to bypass execution blocks by MOTW. T1083 - File and Directory Discovery Magniber searches for files and directories for encryption. T1135 - Network Share Discovery Magniber encrypts files in network/remote drives. T1057 - Process Discovery Magniber uses NtQuerySystemInformation API to obtain running processes in the machine. T1082 - System Information Discover Magniber gathers the computer name of the affected machine, as well as the build number of the compromised windows operating system via the fixed offset [DS]:7FFE026C T1071.001 - Application Layer Protocol: Web Protocols Magniber appends the data gathered form the machine when connecting to the URL of the payment page. T1490 - Inhibit System Recovery Magniber then deletes volume shadow copies via WMIC and by modifying specific registry entries. T1486 - Data Encrypted for Impact It avoids encrypting files with the following folders: • documents and settings • appdata • local settings • sample music • sample pictures • sample videos • tor browser • recycle • windows • boot • intel • msocache • perflogs • program files • programdata • recovery • system volume information • winnt Magniber also avoids encrypting the following files with file attributes: • FILE_ATTRIBUTE_SYSTEM • FILE_ATTRIBUTE_HIDDEN • FILE_ATTRIBUTE_ READYONLY • FILE_ATTRIBUTE_ TEMPORARY • FILE_ATTRIBUTE_ VIRTUAL It avoids encrypting the following folders with file attributes: • FILE_ATTRIBUTE_ SYSTEM • FILE_ATTRIBUTE_HIDDEN • FILE_ATTRIBUTE_ ENCRYPTED Magniber also avoids encrypting files with the following attributes: • FILE_ATTRIBUTE_SYSTEM • FILE_ATTRIBUTE_HIDDEN • FILE_ATTRIBUTE_ READYONLY • FILE_ATTRIBUTE_ TEMPORARY • FILE_ATTRIBUTE_ VIRTUAL Magniber initially encrypts target files via symmetric AES, then encrypts the AES symmetric key and IV via RSA using CryptoAPIs. It encrypts equal-size data blocks (1,048,576 bytes) per iteration until the final block is encrypted. It appends the mutex name as its appended extension. T1608.005 - Stage Capabilities: Link Target Magniber uses typosquatting to trick users into accessing the malicious payload. SUMMARY OF MALWARE, TOOLS, AND EXPLOITS USED Security teams must take not of and be on the lookout for the following tools and exploits typically used in Magniber ransomware attacks: Exploits * CVE-2016-0189 * CVE-2018-8174 * CVE-2019-1367 * CVE-2020-0968 * CVE-2021-26411 * CVE-2021-40444 * CVE-2021-34527 * CVE-2022-44698 Tools * WMI Malware * Fodscript Initial AccessExecutionDefense EvasionPrivilege EscalationImpact * CVE-2016-0189 * WMI * Fodscript * Fodscript * Magniber ransomware * CVE-2018-8174 * CVE-2022-44698 * CVE-2019-1367 * CVE-2020-0968 * CVE-2021-26411 * CVE-2021-40444 * CVE-2021-34527 RECOMMENDATIONS Given its continued activity in 2022, we can expect to see more of the Magniber ransomware in the future. As attackers continue to find ways to distribute its payloads and circumvent security warnings, organizations and their members must remain vigilant to prevent being compromised. We encourage organizations to remain on the lookout for the Magniber ransomware and continue monitoring its evolution to minimize the possibility of a successful attack. To protect systems against the Magniber ransomware and other similar threats, organizations can implement security frameworks that allocate resources systematically to establish a strong defense strategy. Here are some best practices that organizations can consider to help protect themselves from the Magniber ransomware infection: AUDIT AND INVENTORY * Take an inventory of assets and data. * Identify authorized and unauthorized devices and software. * Audit event and incident logs. CONFIGURE AND MONITOR * Manage hardware and software configurations. * Grant admin privileges and access only when necessary to an employee’s role. * Monitor network ports, protocols, and services. * Activate security configurations on network infrastructure devices such as firewalls and routers. * Establish a software allowlist that only executes legitimate applications. PATCH AND UPDATE * Conduct regular vulnerability assessments. * Perform patching or virtual patching for operating systems and applications. * Update software and applications to their latest versions. PROTECT AND RECOVER * Implement data protection, back up, and recovery measures. * Enable multifactor authentication (MFA). SECURE AND DEFEND * Employ sandbox analysis to block malicious emails. * Deploy the latest versions of security solutions to all layers of the system, including email, endpoint, web, and network. * Discover early signs of an attack, such as the presence of suspicious tools in the system. * Use advanced detection technologies such as those powered by AI and machine learning. TRAIN AND TEST * Regularly train and assess employees on security skills. * Conduct red-team exercises and penetration tests. A multilayered approach can help organizations guard possible entry points into the system (endpoint, email, web, and network). Security solutions that can detect malicious components and suspicious behavior can also help protect enterprises. * Trend Micro Vision One™ provides multilayered protection and behavior detection, which helps block questionable behavior and tools early on before the ransomware can do irreversible damage to the system. * Trend Micro Cloud One™ - Workload Security protects systems against both known and unknown threats that exploit vulnerabilities. This protection is made possible through techniques such as virtual patching and machine learning. * Trend Micro™ Deep Discovery™ Email Inspector employs custom sandboxing and advanced analysis techniques to effectively block malicious emails, including phishing emails that can serve as entry points for ransomware. * Trend Micro Apex One™ offers next-level automated threat detection and response against advanced concerns such as fileless threats and ransomware, ensuring the protection of endpoints. INDICATORS OF COMPROMISE (IOCS) The IOCs for this article can be found here. Actual indicators might vary per attack. HIDE Like it? Add this infographic to your site: 1. Click on the box below. 2. Press Ctrl+A to select all. 3. Press Ctrl+C to copy. 4. Paste the code into your page (Ctrl+V). Image will appear the same size as you see above. Posted in Ransomware Spotlight, Ransomware RELATED POSTS * Calibrating Expansion: 2023 Annual Cybersecurity Report * Ransomware Spotlight: LockBit * Trend Micro Security Predictions for 2024: Critical Scalability * Ransomware Spotlight: Trigona * Ransomware Spotlight: Akira RECENT POSTS * Apache APISIX In-the-wild Exploitations: An API Gateway Security Study * Calibrating Expansion: 2023 Annual Cybersecurity Report * Ransomware Spotlight: Rhysida * Ransomware Spotlight: LockBit * Building Resilience: 2024 Security Predictions for the Cloud WE RECOMMEND * Internet of Things * Virtualization & Cloud * Ransomware * Security Technology * MQTT and M2M: Do You Know Who Owns Your Machine’s Data? * Addressing CAPTCHA-Evading Phishing Threats With Behavior-Based AI Protection * A Deep Dive into the Packet Reflection Vulnerability Allowing Attackers to Plague Private 5G Networks * Building Resilience: 2024 Security Predictions for the Cloud * Enhancing Software Supply-Chain Security: Navigating SLSA Standards and the MITRE ATT&CK Framework * Understanding the Kubernetes Security Triad: Image Scanning, Admission Controllers, and Runtime Security * Calibrating Expansion: 2023 Annual Cybersecurity Report * Ransomware Spotlight: LockBit * Trend Micro Security Predictions for 2024: Critical Scalability * Post-Quantum Cryptography: Quantum Computing Attacks on Classical Cryptography * Diving Deep Into Quantum Computing: Computing With Quantum Mechanics * Distributed Energy Generation Gateway (In)Security CRITICAL SCALABILITY: TREND MICRO SECURITY PREDICTIONS FOR 2024 View the 2024 Trend Micro Security Predictions CALIBRATING EXPANSION: 2023 ANNUAL CYBERSECURITY REPORT View the report Try our services free for 30 days * Start your free trial today * * * * * RESOURCES * Blog * Newsroom * Threat Reports * DevOps Resource Center * CISO Resource Center * Find a Partner SUPPORT * Business Support Portal * Contact Us * Downloads * Free Trials * * ABOUT TREND * About Us * Careers * Locations * Upcoming Events * Trust Center * COUNTRY HEADQUARTERS Trend Micro - United States (US) 225 East John Carpenter Freeway Suite 1500 Irving, Texas 75062 Phone: +1 (817) 569-8900 Select a country / region United States expand_more close THE AMERICAS * United States * Brasil * Canada * México MIDDLE EAST & AFRICA * South Africa * Middle East and North Africa EUROPE * België (Belgium) * Česká Republika * Danmark * Deutschland, Österreich Schweiz * España * France * Ireland * Italia * Nederland * Norge (Norway) * Polska (Poland) * Suomi (Finland) * Sverige (Sweden) * Türkiye (Turkey) * United Kingdom ASIA & PACIFIC * Australia * Центральная Азия (Central Asia) * Hong Kong (English) * 香港 (中文) (Hong Kong) * भारत गणराज्य (India) * Indonesia * 日本 (Japan) * 대한민국 (South Korea) * Malaysia * Монголия (Mongolia) and рузия (Georgia) * New Zealand * Philippines * Singapore * 台灣 (Taiwan) * ประเทศไทย (Thailand) * Việt Nam Privacy | Legal | Accessibility | Site map Copyright ©2024 Trend Micro Incorporated. All rights reserved word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word word mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1 mmMwWLliI0fiflO&1