Last Updated on 22/11/2021 by Sunaina
The Magnitude Exploit Kit (EK) has been updated to target Chromium-based browsers on Windows PCs. Magnitude EK was previously known to solely target Internet Explorer. Magnitude EK was recently discovered targeting Windows and Chrome vulnerabilities in a fresh round of assaults, according to Avast security experts.
- Magnitude EK’s developers appear to have introduced support for two additional exploits. The first is aimed against Google Chrome, while the second is aimed at Microsoft’s Windows.
- CVE-2021-21224 is assigned to the exploited Google Chrome vulnerability, and CVE-2021-31956 is assigned to the exploited Windows bug.
- Only Windows builds 18362, 18363, 19041, and 19042 (19H1–20H2) have been targeted in recent assaults. However, no harmful payload appears to be used in the attacks.
CVE-2021-21224: This vulnerability is caused by a type-confusion problem in the V8 rendering engine, which permits RCE. The problem has been exploited in a few attempts, but Google has already patched the flaw. CVE-2021-31956 is a privilege escalation issue that allows attackers to bypass Chrome’s sandbox and gain system privileges. Microsoft addressed this problem in June.
Previously, these two vulnerabilities were leveraged in a malicious operation known as PuzzleMaker, which has yet to be linked to any known threat organization. Magnitude EK does not currently utilize any malicious payload, although this may change in the future. Experts believe that an assault will occur shortly, followed by the distribution of further malware to vulnerable systems. As a result, it is strongly advised to keep the system and software up to date.
