Loading story…
Gwisin ransomware has targeted Korean companies using MSI installers tailored to specific victims. The MSI requires execution arguments to activate its embedded DLL, limiting sandbox visibility; it decrypts shellcode, injects it into legitimate processes including certreq.exe, and encrypts files in memory. The malware can disable security products, install itself as a service, alter boot settings, and reboot hosts into Safe Mode before encryption. Encrypted files receive an extension based on the victim organization’s name, while ransom notes claim data theft and provide attacker contact details.
Defenders can improve visibility into this execution chain by monitoring non-Microsoft-signed DLL loads and correlating DLL telemetry with process, file-timing, and mounted-device metadata. High-value detections include suspicious DLL execution through msiexec, Rundll32, Regsvr32, Office applications, disk-image or archive delivery, DLL sideloading, unusual directories, removable media, and timestomping. DLL-load analytics should be paired with behavior-based shellcode and process-injection detection, malware classification, and UEBA to identify targeted ransomware activity before encryption completes.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Elastic described detection approaches using non-Microsoft-signed DLL image-load telemetry, including correlations with process, signing, device, and file-timing data. The guidance covered malicious DLL execution through Rundll32, Regsvr32, MSIEXEC, disk images, Office documents, archives, LOLBins, and DLL sideloading.
Gwisin ransomware was increasingly used against specifically targeted Korean companies. The campaign used MSI installers requiring special execution arguments, injected decrypted shellcode into legitimate Windows processes, and could reboot systems into Safe Mode to encrypt files.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco Talos reported that the **Qilin** ransomware operation is using a multi-stage infection chain built around a malicious side-loaded `msimg32.dll` to blind defenses before later-stage payloads run. The attack can begin when a legitimate application such as **FoxitPDFReader.exe** loads the rogue DLL, which forwards expected API calls to the real Windows library to avoid suspicion while decrypting and executing additional payloads entirely in memory. Researchers said the loader employs layered evasion, including **SEH/VEH-based control-flow obfuscation**, indirect syscall recovery similar to **Halo’s Gate**, **ETW suppression**, anti-debugging checks, and geofencing that avoids systems configured for post-Soviet locales. In the final stage, the malware deploys an **EDR killer** that can disable more than **300** endpoint security drivers by abusing two helper drivers, `rwdrv.sys` and `hlpdrv.sys`. Talos said the tooling uses physical memory access, kernel object manipulation, termination of protected EDR processes, and removal of kernel callbacks used for monitoring; it also temporarily interferes with **Code Integrity** checks before restoring the `CiValidateImageHeader` callback. The campaign shows Qilin—also tracked as **Agenda**, **Gold Feather**, and **Water Galura**—continuing to target the defense stack itself early in execution, giving ransomware operators a better chance of deploying encryption and follow-on payloads without detection.
Jun 29, 2026
Magniber ransomware operators repeatedly changed their delivery and execution methods to evade Windows protections and security tooling. AhnLab reported that the group distributed Magniber through typosquatted domains and, during one campaign, appended digital signatures to malicious JavaScript and WSF script files so they could bypass Windows **Mark of the Web** (`MOTW`) warnings tied to NTFS alternate data streams, allowing payloads from external sources to run with fewer prompts. The same reporting noted that Magniber later shifted back to **MSI** packages, continuing a pattern of adapting file formats and execution chains to improve infection success. Separate reporting showed Magniber had earlier swapped browser exploit chains from `CVE-2019-1367` to `CVE-2020-0968` after patching reduced the effectiveness of the first flaw, expanding reach to unpatched and unsupported Windows systems. AhnLab also said the operators altered process-injection sequences and adopted the **Heaven’s Gate** technique to make behavior-based and API-hook-based detection harder. Cybereason’s analysis of malicious MSI abuse further linked Magniber to installer-based delivery that can hide payloads in custom actions, embedded binaries, and deceptive installer behavior, underscoring the group’s sustained use of trusted Windows mechanisms to disguise ransomware execution.
Aug 15, 2026
Attackers behind a **Midas ransomware** intrusion spent at least two months inside an unnamed technology vendor before launching encryption, using a combination of internal **RDP**, **PowerShell**, **DISM**, **AnyDesk**, **TeamViewer**, and **Process Hacker** (now known as **System Informer**) to move laterally and prepare the environment. Investigators found evidence that the intruders gained administrator-level access to a domain controller, harvested credentials with **Mimikatz**, exfiltrated data, and repeatedly created malicious **Windows services** to maintain access and stage the attack. The operation culminated in the deployment of a malicious `DismCore.dll` through **DLL sideloading** and the start of ransomware activity on a limited number of servers. Response efforts interrupted the attack before broader encryption could occur, but the case highlighted how a flat network, unused remote-access tools, weak monitoring, and the absence of **MFA** increased the victim’s exposure and enabled the attackers to establish persistence, escalate privileges, and advance toward ransomware execution.
Aug 14, 2026