Loading story…
Magniber ransomware operators repeatedly changed their delivery and execution methods to evade Windows protections and security tooling. AhnLab reported that the group distributed Magniber through typosquatted domains and, during one campaign, appended digital signatures to malicious JavaScript and WSF script files so they could bypass Windows Mark of the Web (MOTW) warnings tied to NTFS alternate data streams, allowing payloads from external sources to run with fewer prompts. The same reporting noted that Magniber later shifted back to MSI packages, continuing a pattern of adapting file formats and execution chains to improve infection success.
Separate reporting showed Magniber had earlier swapped browser exploit chains from CVE-2019-1367 to CVE-2020-0968 after patching reduced the effectiveness of the first flaw, expanding reach to unpatched and unsupported Windows systems. AhnLab also said the operators altered process-injection sequences and adopted the Heaven’s Gate technique to make behavior-based and API-hook-based detection harder. Cybereason’s analysis of malicious MSI abuse further linked Magniber to installer-based delivery that can hide payloads in custom actions, embedded binaries, and deceptive installer behavior, underscoring the group’s sustained use of trusted Windows mechanisms to disguise ransomware execution.
TTPs, infrastructure, and targeting history in one profile.
26 events from the most recent confirmed update back to the earliest known activity.
Microsoft fixed a SmartScreen security bypass in December 2022 and assigned it CVE-2022-44698. Google said Magniber actors had exploited the malformed Authenticode signature flaw before the patch was available.
By 2022-11, researchers observed a newer QBot phishing campaign using malformed-signed JavaScript files inside password-protected archives and IMG images to bypass Mark of the Web and SmartScreen warnings. The script then launched regsvr32 to load a QBot DLL, marking a shift from earlier ISO-based QBot delivery.
BleepingComputer reported that Magniber attacks were exploiting a Windows zero-day where Authenticode-signed files with intentionally malformed signatures could bypass Mark-of-the-Web warnings, and Will Dormann reproduced the issue with proof-of-concept files. Microsoft said it was aware of the reported issue and was investigating it.
AhnLab listed a September 30, 2022 Magniber variant that switched back to an MSI extension and executed via msiexec.exe. The sample still used wscript.exe in the encryption process and modified a custom progID shell open command path via fodhelper.exe.
AhnLab listed a September 28, 2022 Magniber variant delivered as a WSF file and executed via wscript.exe. The sample retained the same general encryption and fodhelper.exe-based registry modification pattern.
AhnLab listed a September 16, 2022 Magniber variant that used a JS extension instead of JSE while continuing to execute via wscript.exe. The sample also used wscript.exe in the encryption process and modified a custom progID shell open command path via fodhelper.exe.
AhnLab reported a September 8, 2022 Magniber variant delivered as a JSE file and executed via wscript.exe. This date also marks the start of the script-based distribution phase highlighted in the report.
Between September 8 and September 29, 2022, AhnLab observed Magniber distributed through typosquatted domains using digitally signed script files to evade Windows Mark of the Web warnings. The technique enabled malicious JavaScript and WSF payloads to run more easily.
AhnLab listed an August 8, 2022 Magniber CPL variant that executed via rundll32.exe and used wscript.exe in the encryption process. It also modified a custom progID shell open command path through fodhelper.exe.
AhnLab reported a July 20, 2022 Magniber variant delivered as a CPL file and executed via rundll32.exe. This marked a change from the earlier MSI-based packaging noted in the same report.
AhnLab listed a June 14, 2022 Magniber variant that again used an MSI extension and msiexec.exe. This version modified HKCU\Software\Classes\(custom progID)\shell\open\command when using fodhelper.exe.
AhnLab listed a Magniber variant dated May 7, 2022 that used an MSI extension and executed via msiexec.exe. The sample also used regsvr32.exe during encryption and modified the ms-settings shell open command path via fodhelper.exe.
Cybereason stated that MSI variants of Qbot began circulating in late April 2022. The activity coincided with Microsoft's introduction of VBA macro auto-blocking, according to the report.
Cybereason noted that the Malware-as-a-Service loader MatanBuchus was identified on Russian cybercrime forums in early 2021. The reference provides only month-level precision by year.
AhnLab said CVE-2019-1367 stopped working on systems that had Microsoft's emergency patch for Windows 10 Version 1903 applied. This drove Magniber to change its exploit-based distribution method.
AhnLab said Magniber distribution resumed on June 26 using an injection sequence based on NtCreateSection, NtMapViewOfSection, NtCreateThreadEx, NtGetContextThread, NtSetContextThread, and NtResumeThread. The actor reportedly kept this API sequence afterward.
AhnLab reported that Magniber distribution ceased on June 10. The pause preceded a later resumption with updated injection behavior.
Since late June 2020, the Magniber operator reportedly used the Heaven's Gate technique to invoke 64-bit system calls directly from 32-bit Internet Explorer under WOW64. AhnLab said this made common API-hook-based detection harder.
AhnLab states that the security patch for CVE-2020-0968 was distributed on April 15, 2020. Magniber later adopted this vulnerability for distribution after moving away from CVE-2019-1367.
AhnLab reported that on March 9, Magniber used an injection chain involving OpenProcess, WriteProcessMemory, SetThreadContext, and ResumeThread. The change was part of repeated attempts to evade behavior-based detection.
Microsoft ended Windows 7 support, which AhnLab says meant Windows 7 systems could not receive the later patch for CVE-2020-0968. This helped expand Magniber's potential victim pool when the actor switched exploits.
Cybereason published a threat analysis on how malicious MSI packages are used for initial access and malware delivery, including case studies on Magniber, MatanBuchus, and Qbot. The report detailed how custom actions, embedded content, and deceptive installer behavior can support compromise.
AhnLab published an analysis of Magniber's September 2022 script-based distribution phase, including its use of appended digital signatures to bypass Mark of the Web protections. The report also noted that Magniber was again being distributed as MSI files at the time of writing.
The November AhnLab report states that ASEC had published a post on October 25 describing changes made to Magniber ransomware. No further event detail is provided in the supplied content.
AhnLab said V3 and the TrueEyes module distributed detections covering both the vulnerable jscript.dll exploit behavior and the Heaven's Gate-based injection technique. The rollout followed the publication of its analysis.
AhnLab published a report describing Magniber's switch from CVE-2019-1367 to CVE-2020-0968 and its evolving process injection methods. The report also documented the actor's use of Heaven's Gate to bypass user-mode hooking.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
9 references tracked. Mallory keeps watching after this page renders.
cybereason.com
Open sourceblog.google
Open sourcebleepingcomputer.com
Open sourceasec.ahnlab.com
Open sourcebleepingcomputer.com
Open sourcethreatresearch.ext.hp.com
Open sourceasec.ahnlab.com
Open sourcelearn.microsoft.com
Open sourcelearn.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Magniber** ransomware operation used multiple Windows and Internet Explorer vulnerabilities to compromise victims, with researchers linking the group to attacks that first abused **PrintNightmare** `CVE-2021-34527` and later shifted to browser-based exploitation through `CVE-2021-26411` and `CVE-2021-40444`. CrowdStrike reported Magniber weaponized the remote code execution variant in the Windows Print Spooler service, while subsequent reporting showed the group moving to malvertising-driven infections that delivered ransomware through Internet Explorer flaws. The activity was heavily concentrated in **South Korea** and broader parts of Asia, matching Magniber’s long-standing regional targeting. Avast said the group’s **Magnitude exploit kit** remained active and mature, using adult-site malvertising, victim-specific subdomains, rapidly rotating infrastructure, and polymorphic obfuscation to reach vulnerable Internet Explorer users. The exploit chain also incorporated `CVE-2020-0986` for local privilege escalation and sandbox escape before deploying Magniber, which encrypts files, attempts to delete shadow copies, and typically avoids data-theft or double-extortion tactics. Researchers noted the ransomware had been rewritten multiple times, remained effectively uncracked, and in some cases contained flaws that could leave encrypted files unrecoverable even for the attackers.
Aug 15, 2026
The **Magnitude exploit kit** remained active and under active development, continuing to deliver ransomware through **malvertising** to users in Asia-Pacific countries despite the broader decline of exploit kits. Over a 12-month period, researchers observed frequent changes to its shellcode, payload delivery, process injection techniques, and anti-analysis logic, indicating sustained operator investment and adaptation. In early 2020, the kit moved from exploiting `CVE-2018-8174` to `CVE-2019-1367`, a Microsoft Internet Explorer flaw in the legacy JScript engine, and also used a previously unknown elevation-of-privilege exploit for `CVE-2018-8641` in `win32k`. The delivered ransomware used **Microsoft CryptoAPI** to encrypt files, dropped ransom notes, and attempted to delete shadow copies through a UAC bypass, reinforcing that unpatched Internet Explorer systems remained exposed to a mature exploit-to-ransomware infection chain.
Aug 14, 2026
**Ransomware activity is increasingly blending into normal IT operations** by combining exploitation of internet-facing software with the use of legitimate remote access and monitoring tools. Huntress reported multiple intrusions tied to the **Crazy** ransomware gang where attackers deployed *Net Monitor for Employees Professional* and the *SimpleHelp* remote support client to maintain persistence, evade detection, and stage for ransomware deployment. The actors installed the monitoring agent via `msiexec.exe` directly from the vendor site, then used it for interactive control (desktop viewing, file transfer, command execution); they also added redundant access by installing SimpleHelp via PowerShell and disguising binaries with benign-looking names (e.g., `vshost.exe`) and paths such as `C:\ProgramData\OneDriveSvc\OneDriveSvc.exe`. In parallel, ransomware groups have been observed **actively exploiting recently patched SmarterTools SmarterMail vulnerabilities** that enable unauthenticated compromise of mail servers. SC Media reported that CISA added **CVE-2026-24423** to the KEV catalog after it was linked to ransomware campaigns; the flaw enables unauthenticated RCE via SmarterMail’s `ConnectToHub` API by delivering a malicious OS command from a remote server. A second issue, **CVE-2026-23760**, allows authentication bypass through the password reset API (`force-reset-password`) by not validating the old password; ReliaQuest attributed active exploitation of this weakness to a China-based actor tracked as **Storm-2603**, which reportedly chained the bypass with SmarterMail’s *Volume Mount* feature to reach RCE, activity assessed as staging consistent with **Warlock** ransomware operations (even when ransomware was not yet deployed).
Jun 29, 2026