Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cybercrime

Magnitude EK Expands Arsenal With PuzzleMaker Exploit Chain

The Magnitude exploit kit (EK) is now capable of targeting Chromium-based browsers running on Windows systems, security researchers with Avast warn.

The Magnitude exploit kit (EK) is now capable of targeting Chromium-based browsers running on Windows systems, security researchers with Avast warn.

Exploit kits such as Magnitude are known for expanding their arsenal with new browser or plugin exploits in a timely fashion, but for years they have mainly focused on Microsoft’s Internet Explorer and left other browsers aside.

This, however, changed when Magnitude added to its arsenal exploits for CVE-2021-21224 and CVE-2021-31956, two vulnerabilities that affect Google’s Chrome browser and Microsoft’s Windows platform, respectively.

CVE-2021-21224, which Google addressed in April, is a type confusion flaw in the V8 rendering engine that could lead to remote code execution (RCE). The bug was already exploited in attacks when fixes rolled out.

CVE-2021-31956, on the other hand, is an elevation of privilege (EoP) vulnerability that could allow attackers to escape Chrome’s sandbox and gain system privileges. When patched in June 2021, the security hole was being abused in attacks alongside CVE-2021-31955, another EoP flaw in Windows.

The two vulnerabilities were previously chained in malicious activity that Kaspersky named PuzzleMaker, but which couldn’t be attributed to any known adversary.

On Tuesday, Avast’s security researchers took to Twitter to raise the alarm on Magnitude now targeting the Chrome and Windows vulnerabilities in a new wave of attacks.

“The attacks we have seen so far are targeting only Windows builds 18362, 18363, 19041, and 19042 (19H1–20H2). Build 19043 (21H1) is not targeted. The exploit for CVE-2021-31956 contains hardcoded syscall numbers relevant just for these builds,” Avast said.

For the time being, the activity doesn’t appear to involve the use of a malicious payload, although it does lead to the victim’s Windows build number being exfiltrated.

Since Magnitude typically tests newly implemented exploits in this manner, it’s likely that malicious attacks will follow soon, likely deploying the Magniber ransomware, Avast also says.

First observed in 2017, Magniber was associated right from the start with Magnitude, and was believed to be developed by the EK’s maintainers.

Related: Purple Fox Exploit Kit Targets Vulnerabilities Linked to DarkHotel Group

Related: Actively Developed Capesand Exploit Kit Emerges in Attacks

Related: New ‘Lord’ Exploit Kit Emerges

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Cybercrime

Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Cybercrime

Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.

Cybercrime

The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.

Cybercrime

No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.

Cybercrime

As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.