Wave of Magniber ransomware hits home users worldwide

A massive ransomware campaign is in the making, encrypting users’ home devices worldwide. Attackers are demanding thousands of dollars in ransom in exchange for a decryption key.

In the past few weeks, BleepingComputer received numerous posts on its forum from people who said their computer and other home devices had been infected with Magniber ransomware.

Ransomware identification site ID-Ransomware noticed a surge in Magniber notifications as well, with almost 720 submissions since Saturday July 20.

The attackers spreading the malware mainly target consumers. For a decryption key, which helps victims to free their device of the ransomware, they demand a $1,000 ransom fee, to be paid in bitcoin. If a victim refuses to pay within three days, they increase the ransom payment to $5,000.

It remains unclear how victims are being infected. A few victims have told BleepingComputer their devices got corrupted after running software cracks or key generators.

Files encrypted with Magniber ransomware can easily be recognized by simply looking at the file extension, which consists of 5 to 9 random characters.

The tech site recommends not to use software cracks and key generators. It’s not only illegal, but it’s also a frequently used way to distribute ransomware or other malware.

Magniber launched in 2017 as a successor to the Cerber ransomware campaign. Since then threat actors have used numerous ways to distribute the malware and encrypt devices, including Windows zero-days, fake browser updates and trojanized key generators.

In 2018, cybersecurity company AhnLab released a free file decryptor for the Magniber ransomware. The developers of the ransomware however managed to fix the bug, making the decryptor useless.