New ransomware attacking APAC nations via malvertising

Cybersecurity researchers have discovered a very sophisticated exploit kit that is targeting countries in the Asia-Pacific region to deliver ransomware via malvertising, which is the spread of malware through online advertisements.

Exploit kits are automated threats that utilise compromised websites to divert web traffic, scan for vulnerable browser-based applications, and run malware.

Called 'Magnitude EK', the constantly-evolving exploit kit uses its own ransomware as its final payload.

The ransomware comes with a temporary encryption key and list of domain names and the attackers keep changing them frequently, according to the cybersecurity firm Kaspersky.

The Magnitude EK switched to an exploit for the more recent vulnerability 'CVE-2019-1367' in an outdated Web browser which was originally discovered as an exploited zero-day in the wild. The Magnitude EK is using it as their primary exploit since February 11, 2020.

"Zero-day vulnerabilities are very risky for businesses, critical infrastructures, government and financial institutions and consumers who are availing themselves to the exposed browser or networks," said Dipesh Kaura, general manager for South Asia at Kaspersky.

Magnitude EK is one of the longest-standing exploit kits. It was on offer in underground forums from 2013 and later became a private exploit kit.

The ransomware delivered by 'Magnitude EK' doesn't encrypt the files located in common folders such as documents and settings, app data, local settings, sample music and tor browsers, among others.

Before encryption, the extensions of files are checked against a hash table of allowed file extensions that contains 715 entries.

A ransom note is left in each folder with encrypted files and at the end a notepad.exe process is created to display the ransom note.

After encryption the ransomware also attempts to delete backups of the files, said the researchers.

"Storing back-up for important data is a basic step that needs to be taken especially by enterprises and government institutions in order to fight against attacks like ransomware", said Kaura.

The implementation of the Magnitude EK technique in its latest variant was an interesting discovery.

Attacks by exploit kits have decreased over the years but they still exist, are still active and pose a threat.

"Although exploit kits may be less rampant today, they prove to be actively maintained and ever-evolving, which remains a threat to users," added Boris Larin, senior security researcher for Russia at Kaspersky.