Beware That Software Update, It Could Be Magniber in Disguise

Threat actors have long been using fake software updates to trick users into downloading malware. And the ongoing massive Magniber ransomware campaign is no different.¹

What’s worse, though, is that apart from losing access to critical files and their possible exposure, victims who don’t have backups and need to regain file access also stand to lose around US$2,500.²

In an effort to help security teams ensure protection, our in-depth investigation into the threat led to the discovery of:

• 80+ domains containing the Windows-specific strings “windows + update,” “windows + patch,” and “windows + security,” two of which have been dubbed “malicious” by various malware engines
• 100+ domains containing the generic software strings “software + update,” “software + patch,” and “software + security,” one of which has been confirmed as a malware host
• 40+ subdomains containing the Windows-specific strings “windows + update,” “windows + patch,” and “windows + security,” two of which have been tagged “malicious” by various malware engines
• 210+ subdomains containing the generic software strings “software + update,” “software + patch,” and “software + security,” 11 of which were confirmed malware hosts

Download a sample of the threat research materials now or contact us to access the complete set of research materials.

—

• [1] https://threatresearch.ext.hp.com/magniber-ransomware-switches-to-javascript-targeting-home-users-with-fake-software-updates/
• [2] https://www.bleepingcomputer.com/news/security/fake-windows-10-updates-infect-you-with-magniber-ransomware/