Loading threat actor…
Magnitude Exploit Kit is a long-running criminal exploit kit active since at least 2013 that has primarily delivered ransomware through malvertising and drive-by browser exploitation. It is widely associated with opportunistic web-based compromise, especially against Internet Explorer users, and has been observed heavily targeting South Korean users, with broader activity across parts of the Asia-Pacific region. Magnitude has delivered multiple ransomware families over time, including Magniber, Locky, Cerber, CryptoWall, and GandCrab, and in later activity consistently deployed its own ransomware payloads. Magnitude is notable for rapid operational adaptation and frequent changes to exploit chains, shellcode, payload staging, process injection methods, and anti-analysis logic. It has used browser and kernel exploit combinations to achieve remote code execution and local privilege escalation, including exploitation of CVE-2019-1367 in Internet Explorer, CVE-2021-21224 in Chromium, CVE-2021-31956 in the Windows kernel, and CVE-2018-8641 in win32k. Observed tradecraft includes malvertising-based initial access, exploit-driven code execution, privilege escalation to SYSTEM, process injection into existing processes, defense evasion through obfuscation and encoded scripts, selective execution checks, and ransomware deployment. In Chromium-focused activity, Magnitude used a V8 exploit chain followed by Windows kernel exploitation and then injected Magniber into a running process to encrypt victim drives. The kit has shown sustained maintenance over multi-year periods, including migration between exploit chains as older vulnerabilities lost effectiveness. It has used Internet Explorer compatibility mode to force vulnerable legacy scripting engines, adopted encoded JScript delivery, and rotated among several injection approaches such as remote thread creation, APC-based execution, section mapping, and related native-thread techniques. Anti-analysis and victim-selection behaviors have included language-based targeting aligned with Korean victims and checks intended to avoid execution in the presence of certain security software or undesirable host conditions. Magnitude is best characterized as a financially motivated cybercriminal operation centered on exploit-kit-driven ransomware delivery rather than espionage. Although some infrastructure and underground-market associations have been discussed publicly, high-confidence attribution to a specific nation state is not established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
14 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Magnitude using CVE-2021-21224 and CVE-2021-31956 ... The exploitation starts with a JavaScript exploit for CVE-2021-21224. This is a type confusion vulnerability in V8, which allows the attacker to execute arbitrary code within a (sandboxed) Chromium renderer process.
Magnitude using CVE-2021-21224 and CVE-2021-31956 ... This is an exploit for CVE-2021-31956, a paged pool buffer overflow in the Windows kernel ... The first one contains an exploit for CVE-2021-31956. This one gets executed first and its goal is to steal the SYSTEM token to elevate the privileges of the current process.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An opportunistic malvertising-driven exploit kit operator that exploited CVE-2019-1367 in the wild, primarily targeting South Korean users and delivering ransomware families.
Exploit kit operator testing and deploying a Chromium exploit chain in the wild, using a V8 renderer exploit and a Windows kernel sandbox escape to deliver Magniber ransomware via drive-by malvertising-style exploitation.
An exploit kit delivering and exploiting CVE-2019-1367 against Internet Explorer users, with indications it targeted Korean users and ultimately dropped a ransomware payload after successful exploitation.
Operating an exploit kit campaign delivering its own ransomware to Asia Pacific countries via malvertising, while actively maintaining and evolving Internet Explorer exploit chains and privilege-escalation/injection tradecraft.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.