Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass
Magniber Ransomware (TL-2026-2481) is a high-severity ransomware operation, first published 2026-09-13. It has no confirmed attribution, affects Microsoft Windows 10, references 2 CVEs (CVE-2023-24880, CVE-2022-44698), maps to 15 MITRE ATT&CK techniques (T1027, T1047, T1055), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-2481
- Threat ID
- TL-2026-2481
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-09-13
- Last reviewed
- 2026-09-13
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- home users, individual consumers, education, government administration, manufacturing, health, technology
- Target regions
- Europe, south korea, Asia-Pacific, taiwan, australia, turkey, japan
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Magniber Ransomware
Malware and tooling: Magniber, Magniber Ransomware, XData
A technical analysis of a completely rewritten Magniber ransomware variant (distinct from the original 2017 family) shows infection via an MSI installer with an obfuscated DLL executed through a Windows Installer CustomAction. The sample uses raw syscalls, a fodhelper.exe UAC bypass, and AES-128-CBC file encryption via Intel AES-NI instructions with RSA-protected keys, appending the '.vieijibfm' extension and dropping a README.html ransom note.
How Magniber Ransomware works
This is a rewritten 2022 build of the Magniber ransomware family (first observed in 2017 targeting South Korea via the Magnitude Exploit Kit), analyzed in depth by researcher hasherezade in March 2023. The sample arrives as an MSI installer that abuses the Windows Installer CustomAction table to execute a binary ('utskzc') which calls an obfuscated exported function ('mvrtubhpxy'), loading the Magniber DLL without a directly-executable payload on disk. The binary is heavily obfuscated with extensive control-flow jump chains and malformed PE data directories that crash dynamic-tracing tools such as Pin Tracer, and it replaces standard WinAPI calls with raw NT syscalls (NtAllocateVirtualMemory, NtCreateUserProcess, NtCreateThreadEx, NtOpenProcess, NtCreateFile, NtOpenKey, NtSetValueKey, etc.) to evade userland API hooking and EDR telemetry. Independent of administrator status, the malware performs a UAC bypass by rewriting the HKCU\Software\Classes\ms-settings\Shell\Open\command registry value so that launching fodhelper.exe auto-elevates and runs Magniber's own commands with high integrity. A dropped, encrypted VBScript in C:\Users\Public\ deletes volume shadow copies via a WMI 'Win32_ShadowCopy' query, disables Windows' Controlled Folder Access protection by zeroing the EnableControlledFolderAccess registry value, drops a ransom-announcement wallpaper image, and self-deletes. File encryption uses a two-stage shellcode design: an injector stage followed by a core encryption engine that generates 16-byte AES keys (restricted to a 67-value byte set, still yielding ~1.65x10^29 possible keys) seeded from NtQueryPerformanceCounter, and encrypts eligible files with AES-128-CBC using Intel AES-NI hardware instructions (AESKEYGENASSIST/AESENC/AESENCLAST). The AES key and IV are then wrapped with a hardcoded 2048-bit RSA public key (e=0x10001); because each sample ships a single RSA keypair, all victims of that build share cryptographic exposure. Encrypted files are appended with the sample-specific extension '.vieijibfm', and a README.html ransom note is placed in every affected directory, directing victims to a Tor .onion negotiation site mirrored through victim-specific clearnet gateway URLs on the domain jobsoon.fun (e.g. http://<victim-id>vieijibfm.jobsoon.fun/). After encrypting 100 or more files, the malware beacons victim statistics (file counts, infection metrics) to a hardcoded domain over plain HTTP GET. This MSI/CustomAction/fodhelper delivery chain matches the broader 2022 evolution of Magniber documented by AhnLab ASEC, which also observed the family shift from running directly on msiexec.exe to injecting into legitimate processes around May 2022. The same operator subsequently pivoted to ZIP-archived JavaScript droppers (September 2022, using a DotNetToJScript variant) and then, from January 2023, to MSI installers with deliberately malformed Authenticode signatures that trigger a Windows SmartScreen error instead of a warning — a technique Google's Threat Analysis Group tracked as exploiting CVE-2023-24880 (a variant of the earlier CVE-2022-44698 SmartScreen/Mark-of-the-Web bypass), with over 100,000 malicious downloads observed, 80%+ concentrated in Europe. No public leak site or multi-affiliate RaaS structure has been identified for Magniber, and no specific threat actor group has been formally attributed.
MITRE ATT&CK techniques used in TL-2026-2481
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.004 File Deletion; T1622 Debugger Evasion
Execution
T1047 Windows Management Instrumentation; T1059.005 Visual Basic; T1106 Native API
Command and Control
Discovery
T1082 System Information Discovery
defense-impairment
T1112 Modify Registry; T1685 Disable or Modify Tools
execution
stealth
Impact
Privilege Escalation
Affected products and versions in Magniber Ransomware
- Microsoft — Windows 10
Vulnerable versions: Windows 10 (build validated at runtime via KUSER_SHARED_DATA; minimum supported build required for the syscall table used) - Microsoft — Windows SmartScreen
Vulnerable versions: Windows 10 version 1607 and later, Windows 11, Windows Server 2016 and later — pre-March 2023 update
Fixed in: Patched March 14, 2023 (CVE-2023-24880)
Remediation for Magniber Ransomware
Patches
- Microsoft Patch Tuesday, March 14, 2023 — CVE-2023-24880 (Windows SmartScreen Security Feature Bypass Vulnerability).
- Microsoft Patch Tuesday, December 13, 2022 — CVE-2022-44698 (Windows SmartScreen Security Feature Bypass Vulnerability).
Immediate actions
- Set User Account Control to 'Always notify' — this specifically breaks the fodhelper.exe auto-elevation bypass used by this sample.
- Block or monitor outbound connections to jobsoon.fun and any newly-registered lookalike ransom-gateway domains.
- Ensure Controlled Folder Access is enforced via policy and alert on writes that zero its EnableControlledFolderAccess registry value.
Workarounds
- Alert on or block modification of HKCU\Software\Classes\ms-settings\Shell\Open\command.
- Alert on msiexec.exe spawning child processes or loading CustomAction DLLs from user-writable temp/download paths.
Longer-term hardening
- Apply Microsoft's March 2023 Patch Tuesday update for CVE-2023-24880 (Windows SmartScreen Security Feature Bypass) fleet-wide.
- Apply Microsoft's December 2022 patch for CVE-2022-44698 (the predecessor SmartScreen/Mark-of-the-Web bypass).
- Deploy EDR/telemetry capable of detecting direct/raw NT syscalls that bypass standard WinAPI hooking.
- Restrict execution of unsigned or freshly-downloaded MSI, APPX, and JavaScript files from non-IT-managed sources via AppLocker or WDAC.
- Maintain offline or immutable backups, since VSS shadow-copy deletion via WMI is standard behavior in this family.
CVEs associated with Magniber Ransomware
CVE-2023-24880, CVE-2022-44698
Timeline of Magniber Ransomware
- Magniber ransomware first identified in the wild, distributed via the Magnitude Exploit Kit and restricted to Korean-locale (0x0412) Windows systems in South Korea.
- Magniber distributed disguised as a digitally-signed APPX package posing as a Chrome/Edge browser update.
- Magniber shifts to a fake Windows 10 update MSI installer that executes an obfuscated DLL via the Windows Installer CustomAction table and adds a fodhelper.exe UAC-bypass step — the rewritten variant analyzed in this threat.
- Magniber's execution model changes from running directly on msiexec.exe to injecting its ransomware payload into legitimate running processes, per AhnLab ASEC.
- Magniber operators pivot to ZIP-archived JavaScript droppers masquerading as antivirus/Windows updates, using a DotNetToJScript variant to load a .NET payload entirely in memory.
- Microsoft patches CVE-2022-44698, the Windows SmartScreen/Mark-of-the-Web bypass Magniber actors had been exploiting via the JScript campaign since September 2022.
- Magniber actors begin a new MSI-based campaign abusing malformed Authenticode signatures (later designated CVE-2023-24880) to trigger a SmartScreen error instead of a warning; Google TAG later measures over 100,000 downloads, roughly 80% concentrated in Europe.
- Microsoft patches CVE-2023-24880 on Patch Tuesday; Google's Threat Analysis Group publishes technical detail on the Magniber MSI signature-corruption bypass the same day.
- Researcher hasherezade (hshrzd) publishes a deep technical analysis of a rewritten 2022 Magniber sample — the source for this threat — detailing raw syscalls, the fodhelper UAC bypass, AES-NI/RSA encryption, and the .vieijibfm extension.
Sources cited for Magniber Ransomware
- Magniber ransomware analysis: Tiny Tracer in action
- Magniber ransomware actors used a variant of Microsoft SmartScreen bypass
- Magniber Ransomware Targets Users with Fake Software Updates
- Magniber ransomware now infects Windows users via JavaScript files
- Change in Injection Method of Magniber Ransomware
- CVE-2023-24880 CVE Record
- Ransomware Spotlight: Magniber
- Magnitude Exploit Kit Now Targeting Korea With Magniber Ransomware
More in ransomware
- Hyadina Rebrands Beast Ransomware as 'GodDamn' and Uses PoisonX Signed Kernel Driver to Disable Endpoint Defenses
- DragonForce Ransomware Attack on RubberMill, Inc. — ~340GB Data Exfiltration Including PII, Credentials, CAD Files with Defense Mil-Spec References
- Vexy Ransomware hits Mega Velocity — 46.68 GB exfiltrated, double extortion
- Rhysida Ransomware Campaign Targeting German Public Administration (Stuttgart and Berlin, 2026)
- Vexy Ransomware (RaaS) claims Sancity (sancity.in) — Indian real estate/construction group; 130 MB data exfiltration alleged
Detection coverage for TL-2026-2481
As of 2026-09-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2481 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.