Tracking Distribution Site of Magniber Ransomware Using EDR

AhnLab ASEC has been blocking the Magniber ransomware through various means since its distribution has continued even after, “Redistribution of Magniber Ransomware in Korea (January 28th),” was posted back in January.

A particular finding at the time was that the ransomware used the <a> tag to bypass domain blocks. In order to detect this, we have researched response measures by tracking the distribution site URL through a different method. The team is …

ahnlab asec back blocking bypass detect distribution domain edr january korea magniber malware analysis order ransomware response tag tracking