New ransomware attacking APAC nations via malvertising

New ransomware attacking APAC nations via malvertising
New ransomware attacking APAC nations via malvertising

Thank you for reading the news about New ransomware attacking APAC nations via malvertising and now with the details

Aden - Yasmine El Tohamy - 'Magnitude EK', a constantly-evolving exploit kit, uses its own ransomware as final payload

Cybersecurity researchers have discovered a very sophisticated exploit kit that is targeting countries in the Asia-Pacific region to deliver ransomware via malvertising, which is the spread of malware through online advertisements.

Exploit kits are automated threats that utilise compromised websites to divert web traffic, scan for vulnerable browser-based applications, and run malware.

Called 'Magnitude EK', the constantly-evolving exploit kit uses its own ransomware as its final payload.

The ransomware comes with a temporary encryption key and list of domain names and the attackers keep changing them frequently, according to the cybersecurity firm Kaspersky.

The Magnitude EK switched to an exploit for the more recent vulnerability 'CVE-2019-1367' in an outdated Web browser which was originally discovered as an exploited zero-day in the wild. The Magnitude EK is using it as their primary exploit since February 11, 2020.

"Zero-day vulnerabilities are very risky for businesses, critical infrastructures, government and financial institutions and consumers who are availing themselves to the exposed browser or networks," said Dipesh Kaura, general manager for South Asia at Kaspersky.

Magnitude EK is one of the longest-standing exploit kits. It was on offer in underground forums from 2013 and later became a private exploit kit.

The ransomware delivered by 'Magnitude EK' doesn't encrypt the files located in common folders such as documents and settings, app data, local settings, sample music and tor browsers, among others.

Before encryption, the extensions of files are checked against a hash table of allowed file extensions that contains 715 entries.

A ransom note is left in each folder with encrypted files and at the end a notepad.exe process is created to display the ransom note.

After encryption the ransomware also attempts to delete backups of the files, said the researchers.

"Storing back-up for important data is a basic step that needs to be taken especially by enterprises and government institutions in order to fight against attacks like ransomware", said Kaura.

The implementation of the Magnitude EK technique in its latest variant was an interesting discovery.

Attacks by exploit kits have decreased over the years but they still exist, are still active and pose a threat.

"Although exploit kits may be less rampant today, they prove to be actively maintained and ever-evolving, which remains a threat to users," added Boris Larin, senior security researcher for Russia at Kaspersky.

These were the details of the news New ransomware attacking APAC nations via malvertising for this day. We hope that we have succeeded by giving you the full details and information. To follow all our news, you can subscribe to the alerts system or to one of our different systems to provide you with all that is new.

It is also worth noting that the original news has been published and is available at Khaleej Times and the editorial team at AlKhaleej Today has confirmed it and it has been modified, and it may have been completely transferred or quoted from it and you can read and follow this news from its main source.