Magniber Ransomware Adopts JavaScript, Targeting Home Users with Fake Software Updates

Rasheed187 · Oct 16, 2022

What is interesting about this attack that it starts with JS files and eventually .Net executables are used to encrypt the files. It also tries to bypass UAC and uses code injection. So it's not a standard .exe file ransomware attack, I wouldn't be surprised if many AV's would fail to detect this. And many users might think that the JS files are harmless.

In recent years, “Big Game Hunting” ransomware attacks against enterprises have dominated media headlines because of their high-profile victims and substantial ransom demands. Yet single-client ransomware – a type of ransomware that infects individual computers, rather than fleets of devices – can still cause significant damage to individuals and organizations. In this article, we share our analysis of a ransomware campaign isolated by HP Wolf Security in September 2022 that targeted home users by masquerading as software updates.
Click to expand...

https://threatresearch.ext.hp.com/m...geting-home-users-with-fake-software-updates/

Rasheed187 · Jan 12, 2023

You know, I was reading this article again and I noticed that they mention it will likely bypass behavior blockers because it makes use of syscalls, I wonder what's up with that?

The attackers used clever techniques to evade protection and detection mechanisms. Most of the infection chain is “fileless”, meaning the malware only resides in memory, reducing the chances of it being detected. Magniber also bypasses detection techniques that rely on user-mode hooks because it uses syscalls instead of standard Windows API libraries.
Click to expand...

Log in or Sign up

Magniber Ransomware Adopts JavaScript, Targeting Home Users with Fake Software Updates

Rasheed187 Registered Member

Rasheed187 Registered Member

Log in or Sign up

Magniber Ransomware Adopts JavaScript, Targeting Home Users with Fake Software Updates

Rasheed187 Registered Member

Rasheed187 Registered Member

Useful Searches