Threat Signal Report

Magniber Ransomware Delivered to South Korean Victims Through PrintNightmare Vulnerability

Description

FortiGuard Labs is aware of a report that the Magniber ransomware is delivered to the victims in South Korea by exploiting the PrintNightmare vulnerability for which Microsoft released an emergency patch on July 6th, 2021. Delivery of the Magniber payload onto South Korean victims comes as no surprise as the ransomware is known to solely target South Korean users back in 2017 through the Magnitude exploit kit.


What is PrintNightmare?

PrintNightmare is a name for a remote code execution vulnerability affecting Microsoft Windows Print Spooler, which Microsoft released an out-of-band patch on July 6th, 2021. Successfully exploiting PrintNightmare allows the attacker to run arbitrary code with SYSTEM privileges.


FortiGuard Labs previously published a Threat Signal for PrintNightmare. See link to "#PrintNightmare Zero Day Remote Code Execution Vulnerability" in the Appendix.


Why is the Incident Significant?

While the patch is already out for PrintNightmare, this is still significant as Windows Print Spooler is enabled by default on all Windows systems and a Proof-of-Concept code to exploit the vulnerability was briefly available online.


The PrintNightmare vulnerability is considered severe enough to prompt Microsoft to release an out-of-band patch on July 6th, 2021. Since it's only been just over 30 days after the patch was released, there may still be a lot of unpatched machines in the wild.


Who were the Targets of the Attack?

According to security vendor Crowd Strike, Magniber ransomware gang targeted users in South Korea.


What is Magniber ransomware?

Magniber ransomware is a malware that encrypts files on the compromised system and demands the victim to pay ransom in order to recover the encrypted files.

Upon infection, the victim is instructed to visit the threat actor's Web page using TOR browser.


What is the Status of Coverage?

FortiGuard Labs provides the following AV coverage against this attack:

W64/Injector.FR!tr

Malicious_Behavior.SB

W32/Encoder.NCX!tr


FortiGuard Labs has IPS coverage in place for this vulnerability and known proof of concept code as (definitions version 18.109):

MS.Windows.Print.Spooler.AddPrinterDriver.Privilege.Escalation


Any Other Suggested Mitigation?

The potential for damage to daily operations, reputation, and unwanted release of data, the disruption of business operations, etc. is apparent, and because of this it is important to keep all AV and IPS signatures up to date. It is also important to ensure that all known vendor vulnerabilities within an organization are addressed once available, and updated on a regular basis to protect against attackers establishing a foothold within a network.


Definitions

Traffic Light Protocol

Color When Should it Be used? How may it be shared?

TLP: RED

Not for disclosure, restricted to participants only.
Sources may use TLP:RED when information cannot be effectively acted upon by additional parties, and could lead to impacts on a party's privacy, reputation, or operations if misused. Recipients may not share TLP:RED information with any parties outside of the specific exchange, meeting, or conversation in which it was originally disclosed. In the context of a meeting, for example, TLP:RED information is limited to those present at the meeting. In most circumstances, TLP:RED should be exchanged verbally or in person.

TLP: AMBER

Limited disclosure, restricted to participants’ organizations.
Sources may use TLP:AMBER when information requires support to be effectively acted upon, yet carries risks to privacy, reputation, or operations if shared outside of the organizations involved. Recipients may only share TLP:AMBER information with members of their own organization, and with clients or customers who need to know the information to protect themselves or prevent further harm. Sources are at liberty to specify additional intended limits of the sharing: these must be adhered to.

TLP: GREEN

Limited disclosure, restricted to the community.
Sources may use TLP:GREEN when information is useful for the awareness of all participating organizations as well as with peers within the broader community or sector. Recipients may share TLP:GREEN information with peers and partner organizations within their sector or community, but not via publicly accessible channels. Information in this category can be circulated widely within a particular community. TLP:GREEN information may not be released outside of the community.

TLP: WHITE

Disclosure is not limited.
Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction.