Loading story…
The Magnitude exploit kit remained active and under active development, continuing to deliver ransomware through malvertising to users in Asia-Pacific countries despite the broader decline of exploit kits. Over a 12-month period, researchers observed frequent changes to its shellcode, payload delivery, process injection techniques, and anti-analysis logic, indicating sustained operator investment and adaptation.
In early 2020, the kit moved from exploiting CVE-2018-8174 to CVE-2019-1367, a Microsoft Internet Explorer flaw in the legacy JScript engine, and also used a previously unknown elevation-of-privilege exploit for CVE-2018-8641 in win32k. The delivered ransomware used Microsoft CryptoAPI to encrypt files, dropped ransom notes, and attempted to delete shadow copies through a UAC bypass, reinforcing that unpatched Internet Explorer systems remained exposed to a mature exploit-to-ransomware infection chain.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
On March 16, 2020, the exploit kit added logic to avoid injecting its payload into explorer.exe, reflecting another change in its process injection behavior.
Also on February 11, 2020, Magnitude EK added logic to check for the ASDSvc process associated with AhnLab and avoid executing the payload from Internet Explorer if that process was present.
On February 11, 2020, Magnitude EK changed its primary browser exploit from CVE-2018-8174 to CVE-2019-1367, reusing the original Internet Explorer zero-day exploit with modified shellcode and obfuscation.
During 2019, Magnitude EK used CVE-2018-8174 as its exploit, matching a broader pattern seen across other exploit kits at the time.
The article says the win32k elevation-of-privilege vulnerability CVE-2018-8641 used by Magnitude EK was fixed by Microsoft in December 2018.
The Securelist analysis states that Magnitude exploit kit has existed since at least 2013 and was originally advertised on underground forums before later becoming a private exploit kit.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Magniber** ransomware operation used multiple Windows and Internet Explorer vulnerabilities to compromise victims, with researchers linking the group to attacks that first abused **PrintNightmare** `CVE-2021-34527` and later shifted to browser-based exploitation through `CVE-2021-26411` and `CVE-2021-40444`. CrowdStrike reported Magniber weaponized the remote code execution variant in the Windows Print Spooler service, while subsequent reporting showed the group moving to malvertising-driven infections that delivered ransomware through Internet Explorer flaws. The activity was heavily concentrated in **South Korea** and broader parts of Asia, matching Magniber’s long-standing regional targeting. Avast said the group’s **Magnitude exploit kit** remained active and mature, using adult-site malvertising, victim-specific subdomains, rapidly rotating infrastructure, and polymorphic obfuscation to reach vulnerable Internet Explorer users. The exploit chain also incorporated `CVE-2020-0986` for local privilege escalation and sandbox escape before deploying Magniber, which encrypts files, attempts to delete shadow copies, and typically avoids data-theft or double-extortion tactics. Researchers noted the ransomware had been rewritten multiple times, remained effectively uncracked, and in some cases contained flaws that could leave encrypted files unrecoverable even for the attackers.
Aug 15, 2026
Multiple exploit kits remained active despite the broader decline of the exploit-kit ecosystem, using **malvertising**, compromised sites, and traffic distribution systems to drive victims to landing pages that exploited legacy **Internet Explorer** and **Adobe Flash Player** vulnerabilities. Reports identified **RIG, Spelevo, PurpleFox, Underminer, Bottle, Magnitude, Angler,** and **GreenFlash Sundown** abusing flaws including `CVE-2021-26411`, `CVE-2020-1380`, `CVE-2018-8174`, `CVE-2018-15982`, `CVE-2018-4878`, `CVE-2016-0189`, and `CVE-2015-0311`. Researchers said continued Internet Explorer use, unsupported Flash installations, and region-specific targeting kept drive-by download attacks viable, particularly across Japan, South Korea, Taiwan, Hong Kong, Malaysia, and other parts of Asia. The campaigns delivered a wide range of malware families, showing that exploit kits were still an effective access vector for both cybercrime and broader malware operations. **Spelevo** was tied to the Japanese **PseudoGate** campaign distributing **Ursnif**, **SmokeLoader**, **Ramnit**, **Kronos**, and **Zloader**; **RIG** was seen pushing **Pitou.B** and ransomware such as **CryptoLuck** and **Revenge**; **Magnitude** delivered **Magniber** ransomware; **Underminer** deployed a **bootkit** and **coinminer**; **GreenFlash Sundown** delivered **Hermes** ransomware; **Angler** installed the **Bedep** trojan; and **PurpleFox** was linked to **DirtyMoe** cryptojacking and DDoS malware. The reporting underscored that unpatched or unsupported browsers and plugins continued to expose organizations to silent compromise, ransomware, banking trojans, spam bots, and cryptomining infections.
Aug 15, 2026
Magniber ransomware operators repeatedly changed their delivery and execution methods to evade Windows protections and security tooling. AhnLab reported that the group distributed Magniber through typosquatted domains and, during one campaign, appended digital signatures to malicious JavaScript and WSF script files so they could bypass Windows **Mark of the Web** (`MOTW`) warnings tied to NTFS alternate data streams, allowing payloads from external sources to run with fewer prompts. The same reporting noted that Magniber later shifted back to **MSI** packages, continuing a pattern of adapting file formats and execution chains to improve infection success. Separate reporting showed Magniber had earlier swapped browser exploit chains from `CVE-2019-1367` to `CVE-2020-0968` after patching reduced the effectiveness of the first flaw, expanding reach to unpatched and unsupported Windows systems. AhnLab also said the operators altered process-injection sequences and adopted the **Heaven’s Gate** technique to make behavior-based and API-hook-based detection harder. Cybereason’s analysis of malicious MSI abuse further linked Magniber to installer-based delivery that can hide payloads in custom actions, embedded binaries, and deceptive installer behavior, underscoring the group’s sustained use of trusted Windows mechanisms to disguise ransomware execution.
Aug 15, 2026