Change in Magniber Ransomware (*.js → *.wsf) – September 28th

The ASEC analysis team has explained through the blog post on September 8th that the Magniber ransomware has changed from having a CPL extension to a JSE extension. The attacker made another change after September 8th, changing the file extension from JSE to JS on September 16th. And on September 28th, the attacker changed the distribution method once again, changing the file extension from JS to WSF. It seems the attacker is continuously distributing variations to bypass various detection methods … Continue reading Change in Magniber Ransomware (*.js → *.wsf) – September 28th