Magniber Ransomware Detection: Threat Actors Spread JavaScript Files Targeting Windows Users
Table of contents:
Throughout 2021-2022, ransomware continues to be one of the dominant trends in the cyber threat landscape, illustrated by the increasing sophistication of intrusions and a rapidly growing number of ransomware affiliates. Cybersecurity researchers warn of the ongoing malicious campaigns, which target Windows users and distribute Magniber ransomware disguised as software updates.
Detect Magniber Ransomware
Magniber ransomware attacks against Windows users can pose significant risks due to the use of adversary techniques to bypass detection, obfuscation, and more advanced offensive capabilities that can lure a potential victim into triggering an infection chain. To help cybersecurity professionals timely identify the malicious presence in their environment, SOC Prime’s platform curates a new Sigma rule for Magniber ransomware detection. The detection algorithm crafted by our keen Threat Bounty Program developer Aykut Gurses detects JavaScript file activity that initiates infection by Magniber ransomware. Follow the link below to instantly drill down to this Sigma rule and all relevant context, including MITRE ATT&CK® references, media links, threat intelligence, and executable binaries:
Detection of JavaScript File Activity That Started a Magniber Ransomware Infection (via cmdline)
This Sigma-based threat hunting query can be leveraged across 23 SIEM, EDR, and XDR solutions and is benchmarked against the MITRE ATT&CK framework addressing the Impact tactic with the corresponding Data Encrypted for Impact (T1486) and Inhibit System Recovery (T1490) techniques.
Threat Hunters and Detection Engineers eager to hone and monetize their Sigma & ATT&CK skills can join the ranks of crowdsourced development and take part in our Threat Bounty Program. Submit your own detections, build up your hard skill profile, and share your expertise with industry peers.
To proactively defend against all existing and emerging Magniber ransomware attacks, hit the Explore Detections button and instantly reach the entire collection of relevant context-enriched Sigma rules along with their translations. No strings attached — access to detections and their cyber threat context is available without registration.
Magniber Ransomware Analysis: Recent Attacks Spreading Infection Via JavaScript Files
A new wave of Magniber ransomware attacks causes a stir in the cyber threat arena. Magniber ransomware operators spread malicious samples via JavaScript files masquerading as security updates and affecting Windows 10 and 11 versions. According to the latest report by the HP Threat Research experts, attackers demand compromised users to pay a ransom of up to $2,500 to decrypt and recover their infected data. Notably, in previous adversary campaigns, Magniber ransomware was delivered via MSI and EXE files, now switching to JavaScript techniques typical of the most recent attacks.
Magniber’s infection chain in the ongoing attacks starts with downloading malicious ZIP archives containing JavaScript, which are disguised as fake anti-virus of Windows 10 software updates. Once extracting the ZIP file and downloading JavaScript, the vulnerable devices are infected with file-encrypting ransomware strains. The malicious JavaScript files leveraged by Magniber ransomware operators are obfuscated and apply sophisticated detection evasion techniques, like the one similar to “DotNetToJScript” by running a .NET file in the system memory and attempting to bypass detection by anti-virus software. The .NET file decodes shellcode, which removes shadow copy files from the compromised system and disables backup and data recovery capabilities via corresponding Windows utilities, enabling threat actors to increase their chances of receiving a ransom. To delete shadow copy files and block Windows recovery settings, Magniber uses the Windows UAC (User Account Control) feature, which allows attackers to run operations with elevated privileges. At the final stages of the attack life cycle, Magniber ransomware encrypts files and drops ransom notes addressing compromised users with the details of the file recovery after the payment.
As Magniber ransomware mitigation measures, cyber defenders recommend leveraging admin accounts for home users only in the case of utmost necessity, downloading software and its updates only from legitimate and trusted web resources, and continuously backing up user data to ensure proper system protection and data security.
Immediate access to over 650 unique Sigma rules to detect ransomware is just a few clicks away! Get 30+ rules for free or reach all detections with On-Demand at http://my.socprime.com/pricing. Learn more about how to detect 95% faster than your peers and drive immediate value with On Demand here.
