Magnitude

Magnitude Exploit Kit is a long-running web-based exploit kit active since at least 2013 and notable for sustained use well after the broader exploit-kit ecosystem declined. It is primarily associated with drive-by compromise through malvertising and redirector infrastructure, including the Magnigate filtering gate, to profile victims and deliver browser-based exploitation chains. The kit has been observed targeting Internet Explorer extensively and, in 2021, briefly testing a Chromium exploit chain in the wild.

Magnitude is best known for delivering ransomware payloads, especially Magniber, and previously delivered other ransomware families including Cerber and GandCrab. Its campaigns were historically concentrated on South Korea and later expanded to parts of the Asia-Pacific region including Taiwan, Hong Kong, and Malaysia. Regional targeting and victim filtering have been a recurring operational characteristic.

Observed exploitation by Magnitude has included Internet Explorer vulnerabilities such as CVE-2018-8174 and CVE-2021-26411, as well as a Chromium chain using CVE-2021-21224 for renderer code execution and CVE-2021-31956 for Windows kernel privilege escalation. In documented chains, successful browser exploitation led to shellcode execution, staged payload retrieval, and delivery of a loader that injected the final ransomware payload into a running process. The Chromium chain demonstrated mature post-exploitation tradecraft, including sandbox escape, SYSTEM token theft, process injection, and cleanup steps intended to avoid system instability.

Magnitude remains one of the most prominent surviving exploit kits of its era and has been closely linked to Magniber operations since at least 2017. Its role is primarily as an exploitation and delivery platform rather than the final payload itself, enabling initial access and follow-on malware execution on Windows systems through browser-driven drive-by attacks.