Microsoft identified Magniber deployments from the Russian cybercrime group that it tracks as Storm-0381 through its heavy use of malvertising.
Magniber
Magniber is a Windows ransomware family first observed in 2017 and long associated with exploit-driven and socially engineered delivery.
Profile source: Mallory opens in a new tabMagniber
Family profile
Magniber is a Windows ransomware family first observed in 2017 and long associated with exploit-driven and socially engineered delivery. It has been distributed through the Magnitude exploit kit, malicious advertisements, fake browser or Windows updates, typosquatted download sites, signed script files, MSI installers, APPX packages, and phishing-delivered JavaScript. Multiple campaigns abused Internet Explorer and Windows vulnerabilities including CVE-2018-8174, CVE-2019-1367, CVE-2020-0968, CVE-2021-26411, CVE-2021-40444, CVE-2021-34527, and the SmartScreen bypass CVE-2022-44698 to execute without normal user warnings or to gain code execution on vulnerable systems.
Magniber primarily targets Windows systems and has historically shown strong concentration in South Korea, later expanding to other parts of Asia including Taiwan, Hong Kong, Malaysia, Singapore, and Chinese-language locales. Some campaigns also spread more broadly to consumer victims worldwide through fake software-update lures. The malware encrypts files and drops ransom notes, while many reports note that it generally focused on encryption rather than data theft or double-extortion operations.
Technically, Magniber has undergone repeated rewrites and operational changes to improve evasion and resilience. Reported variants use obfuscation, dynamic API resolution, malformed or corrupted Authenticode signatures to bypass Mark-of-the-Web and SmartScreen protections, reflective DLL loading, and process injection to run inside legitimate processes. Some campaigns used shellcode loaders, in-memory execution, MSI custom actions, APPX-based staging, and Heaven’s Gate techniques to reduce visibility to user-mode security tooling. Magniber operators also changed injection sequences over time to evade behavior-based detection and have used privilege-escalation or exploit chains in conjunction with browser-based delivery.
Encryption behavior documented across campaigns includes AES-based file encryption with per-file keys and IVs, with the symmetric material protected using RSA and appended to encrypted files. Later variants no longer depended on a command-and-control server or hardcoded online key retrieval for encryption, instead embedding attacker-controlled public-key material locally. Magniber has also been observed deleting shadow copies and otherwise hindering recovery.
Magniber has been linked in reporting to cybercriminal activity tracked by Microsoft as Storm-0381, and its ecosystem has intersected with exploit suppliers and malvertising operations. It remains notable for sustained adaptation in delivery and defense evasion, especially its repeated use of browser and Windows trust-boundary weaknesses to reach victims.
Capabilities
- Defense Evasion
- Exfiltration
- Privilege Escalation
- Process Injection
Operational record
1
YARA rules
1
Leak sites
0 available
Reported operators
Threat actors
1 named in public reportingExploited software
Vulnerabilities linked to Magniber
13 CVEs CVE-2021-34527 PrintNightmare CVE-2021-40444 MSHTML Remote Code Execution in Microsoft Windows CVE-2018-8174 Windows VBScript Engine Remote Code Execution Vulnerability CVE-2021-26411 Internet Explorer Memory Corruption Vulnerability CVE-2021-31956 Windows NTFS Elevation of Privilege Vulnerability CVE-2018-8641 Win32k Elevation of Privilege Vulnerability in Windows Kernel-Mode Driver CVE-2021-21224 Type Confusion in V8 (Google Chrome < 90.0.4430.85) CVE-2020-0968 Scripting Engine Memory Corruption Vulnerability in Microsoft Internet Explorer CVE-2019-1367 Scripting Engine Memory Corruption Vulnerability in Internet Explorer CVE-2022-44698 Windows SmartScreen Security Feature Bypass via Malformed Authenticode Signature CVE-2020-0986 Windows splwow64 GDI Print/Print Spooler API Elevation of Privilege CVE-2021-1675 Windows Print Spooler Remote Code Execution Vulnerability CVE-2022-41091 Windows Mark of the Web Security Feature Bypass
MITRE ATT&CK
Magniber in ATT&CK
37 distinct techniquesTechniques
37 techniques T1059.005 Visual Basic T1055 Process Injection T1614.001 System Language Discovery T1189 Drive-by Compromise T1486 Data Encrypted for Impact T1190 Exploit Public-Facing Application T1027.007 Dynamic API Resolution T1059 Command and Scripting Interpreter T1027 Obfuscated Files or Information T1620 Reflective Code Loading T1583.001 Domains T1548.002 Bypass User Account Control T1204 User Execution T1068 Exploitation for Privilege Escalation T1218.010 Regsvr32 T1106 Native API T1055.003 Thread Execution Hijacking T1548 Abuse Elevation Control Mechanism T1218.011 Rundll32 T1112 Modify Registry T1203 Exploitation for Client Execution T1059.007 JavaScript T1553.005 Mark-of-the-Web Bypass T1490 Inhibit System Recovery T1553.002 Code Signing T1140 Deobfuscate/Decode Files or Information T1036 Masquerading T1574 Hijack Execution Flow T1105 Ingress Tool Transfer T1583 Acquire Infrastructure T1218 System Binary Proxy Execution T1204.002 Malicious File T1562 Impair Defenses T1083 File and Directory Discovery T1070.004 File Deletion T1041 Exfiltration Over C2 Channel T1129 Shared Modules
Reporting
Research mentioning Magniber
Mar 1
Elastic Security Labs
Hunting for Suspicious Windows Libraries for Execution and Defense Evasion | Elastic Security Labs
Gwisin ransomware has targeted Korean companies using MSI installers tailored to specific victims. The MSI requires execution arguments to activate its embedded DLL, limiting sandbox visibility; it decrypts shellcode, injects it into legitimate processes including certreq.exe, and encrypts files in memory. The malware can disable security products, install itself as a service, alter boot settings, and reboot hosts into Safe Mode before encryption. Encrypted files receive an extension based on the victim organization’s name, while ransom notes claim data theft and provide attacker contact details. Defenders can improve visibility into this execution chain by monitoring non-Microsoft-signed DLL loads and correlating DLL telemetry with process, file-timing, and mounted-device metadata. High-value detections include suspicious DLL execution through msiexec, Rundll32, Regsvr32, Office applications, disk-image or archive delivery, DLL sideloading, unusual directories, removable media, and timestomping. DLL-load analytics should be paired with behavior-based shellcode and process-injection detection, malware classification, and UEBA to identify targeted ransomware activity before encryption completes.
Jul 26
Ahnlab Asec
