BleepingComputer has reported on a recent uptick in ransomware attacks targeting home users with Magniber ransomware. Magniber ransomware was first launched in 2017, and the operation has ebbed and flowed since then. Historically, Magniber ransomware has been spread through various means such as Windows zero-days and fake Windows and browser updates. In 2018, AhnLab released a decryptor for the ransomware which unfortunately no longer works against later versions of Magniber. As of July 20, 2024, BleepingComputer has observed what they are calling a surge in Magniber ransomware victims seeking help in their forums. It is currently unclear how recent victims are being infected, however some victims have reported running software cracks or key generators prior to the Magniber encryption. Once encrypted, files are appended with a random character extension and a ransom note named “READ_ME.htm” is created on the victim’s machine. The ransom note instructs victims to download the Tor browser and provides a link to the threat actor’s dark web site. The dark web site then provides users with instructions on making payment to the threat actor via Bitcoin for the decryption key, which is priced at $1,000 for the first three days and $5,000 after that deadline. There is currently no known working decryptor for the Magniber ransomware. BleepingComputer warns users against downloading and running software cracks and key generators. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.