MVISION Insights: Magnat campaigns target multiple countries with Malvertising

Technical Articles ID: KB95234
Last Modified: 1/25/2022

Environment

IMPORTANT: This Knowledge Base article discusses a specific threat that is being automatically tracked by MVISION Insights technology. The content is intended for use by MVISION Insights users, but is provided for general knowledge to all customers. Contact us for more information about MVISION Insights.

Summary

Description of Campaign
Information stealers, backdoors, and a malicious Chrome extension were distributed in Magnat malvertising campaigns. The malware used in the operation included MagnatBackdoor, MagnatExtension, Azorult, and Redline. The Plink SSH command-line tool for Windows and the RDPWrapper open-source application were also used to carry out the infection process. The attacks date back to 2018, continued until late 2021, and focused on users mostly in Canada, the United States, and Australia.

The McAfee Enterprise ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports. This campaign was researched by Cisco Systems and shared publicly here.

How to use this article:

If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign.
Review the product detection table and confirm that your environment is at least on the specified content version.
To download the latest content versions, go to the Security Updates page.
Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
Review KB91836 - Countermeasures for entry vector threats.
Review KB87843 - Dynamic Application Containment rules and best practices.
Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

Threat Hunting:

YARA	rule AutoIT_Script { meta: description = "Identifies AutoIT script." author = "@bartblaze" date = "2020-09" tlp = "White" strings: $ = "#OnAutoItStartRegister" ascii wide $ = "#pragma compile" ascii wide $ = "/AutoIt3ExecuteLine" ascii wide $ = "/AutoIt3ExecuteScript" ascii wide $ = "/AutoIt3OutputDebug" ascii wide $ = ">>>AUTOIT NO CMDEXECUTE<<<" ascii wide $ = ">>>AUTOIT SCRIPT<<<" ascii wide $ = "This is a third-party compiled AutoIt script." ascii wide condition: uint16(0) != 0x5A4D and any of them }
YARA	rule AutoIT_Compiled { meta: description = "Identifies compiled AutoIT script (as EXE)." author = "@bartblaze" date = "2020-09" tlp = "White" strings: $ = "#OnAutoItStartRegister" ascii wide $ = "#pragma compile" ascii wide $ = "/AutoIt3ExecuteLine" ascii wide $ = "/AutoIt3ExecuteScript" ascii wide $ = "/AutoIt3OutputDebug" ascii wide $ = ">>>AUTOIT NO CMDEXECUTE<<<" ascii wide $ = ">>>AUTOIT SCRIPT<<<" ascii wide $ = "This is a third-party compiled AutoIt script." ascii wide condition: uint16(0) == 0x5A4D and any of them }
YARA	rule RDPWrap { meta: description = "Identifies RDP Wrapper, sometimes used by attackers to maintain persistence." author = "@bartblaze" date = "2020-05" reference = "https://github.com/stascorp/rdpwrap" tlp = "White" strings: $ = "rdpwrap.dll" ascii wide $ = "rdpwrap.ini" ascii wide $ = "RDP Wrapper" ascii wide $ = "RDPWInst" ascii wide $ = "Stas'M Corp." ascii wide $ = "stascorp" ascii wide condition: any of them }

This Knowledge Base article discusses a specific threat that is being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.

Campaign IOC

Type	Value
SHA256	DF3E587781523F2B9A2080CAA9856D52B103302EBF311BBFEEA54ACB89F4B90D
SHA256	1109F4F612577BA61A8437309FD8BBD164D942090A10D490D6339F6FFB05F2CF
SHA256	D06EA637979440EDF76A679C0E8608E00DAE877BFC10E642A4D9D509BE2BB2A9
SHA256	EA3D8E8C07E87FAB40FC0E30DAEA0307C1F0119C6B63A50759625A1EDB777A58
SHA256	933AC399735239F00815637995C752757D867CC601B80274E62EF613C54CD510
SHA256	C997D6CA731762B6EB874296B8DEA931095BB5D59F6E2195F02CFAD246994A07
SHA256	794833762B3A94A9B1E88FFB915352823B7192255AA7AC86BBE9F93A64395854
SHA256	13CE97767C92B0F048B0CB4BF55CE8E928A77DC209C428B02DE0A890F8F1EC13
SHA256	A3B5DA275B97840A1E9E5F553D638BFB8E095102EDD305008CA2875294B4DEB1
SHA256	42178057B6914172E9101DDD265D88501E4518A92E854AD2EF6E8401D3BDBD15
SHA256	A70525F4AAF688588A65CB60FB18F9CC69B895D12DA87CD39BA58F17DB37D531
SHA256	0FDE03BD190B9601983C97C4138C5953429A672530F585E53B5725B241C35CBB
SHA256	7D22568C2D8F94852B59F5B01B12289419DC2E617C7977D2262E1061906D3FB3
SHA256	C915342445A40722379BF91CF3AE3B846C6CD7BAC069AD1040E2C22ADDBCA1FD
SHA256	65784E672CCAA01697D47837EF036A06E180B394DA60011374A7F4E8F3649492
SHA256	6FFC9BACB24EC4484A006DC3183984AF2B7EAEF0244FA5C0E96020081287CA62
SHA256	9B89464C0543E98D6A96FFAA34B78EF62E48182736482DDD968DB17DC9E3076E
SHA256	BA7BB63B7CF08CFE48AEAD5EC65E81B35B89F4559D16257BA283F77251C15E32
SHA256	1C602FC24A980135F9736D55986D694A4B542D69E6CAA225D99C3E9E9C251A1A
SHA256	28529E85F66CCFCC1B3EF43F37398CAC1716F191775487A99BFE83A66554397A
SHA256	68AEBB2F33F1475ABC863495A1BF4A43DE6FA267BEDAD1E64A037F60E3DA707D
SHA256	EF44590FA6F19431C0B2182627F95B6B9568BD2700124BFC7ABE4A979A363BB6
SHA256	41F9F0DD85B9D1860CBF707471572619218343E1113FA85158F7083D83FCAA0C
SHA256	0CAE9A4E0E73FF75F3FFA7F2D58EE67DF34BC93E976609162CD6381EA9EB6F5B
SHA256	45B9894E4CAC3C21F28308EE48A0095E9516F8B1C26483C1A58B47A9FBBE27E9
SHA256	AC1DF77C0D6D3C35DA7571F49F0F66F144FBCFD442411585E48A82E2F61B1FC1
SHA256	ED5ABE5B0B9FB82A455EF0E750F44838E1272E743F079871161A2FA179B081F3
SHA256	E2E66789C7F6627BFB270C609BAE28CD9DF7D369A5BA504DCCC623EB11F9E3F2
SHA256	09158BF9C73F856F8A310FFA7238042D08D3A475EA34FFA6CEE9E88D841C4A7E
SHA256	FBAA11E154C41B8B3E18E6DB587D7C9F612EC7A1983ACA8EC8A9DBB2322A3A9F
SHA256	C7E703543814E6B70C0F1B2FE990F0251246DBE7931D7D7EE53B0E559D00E405
SHA256	C8864081450FBF75D2757716EF237E81C4F419C2E2A3E2DEB86432E78412F109
SHA256	F12649DE9F93F6DC29A1C6838779885B733C95D4157F95BC92D3F81F52B41788
SHA256	CB40A5957081D6030E983BCC3E13122660236379858024CFDA932117F8D6125F
SHA256	B6CF71093407D3548E25ADC93CCC867602D5D5860753D480308A81273A483BEE
URL	https://chocolatepuma.casa/api/ping
URL	https://wormbrainteam.club/api/ping
URL	https://430lodsfb.xyz/api/ping
URL	https://softstatistic.xyz/api/ping
URL	https://happyheadshot.club/api/ping
URL	https://aaabasick.fun/api/ping
URL	https://nnyearhappy.club/api/ping
URL	https://teambrainworm.club/api/ping
URL	https://yanevinovat.club/api/ping
URL	https://fartoviypapamojetvse.club/api/ping
URL	https://hugecarspro.space/api/ping
URL	https://burstyourbubble.icu/api/ping
URL	https://boogieboom.host/api/ping
URL	https://cgi-lineup.website/api/ping
URL	https://newdawnera.fun/api/ping/
URL	https://bhajhhsy6.site/api/ping/
URL	https://iisnbnd7723hj.digital/api/ping
URL	https://sdcdsujnd555w.digital/api/ping
URL	http://0-800-email.com/index.php
URL	http://430lodsfb.club/index.php
URL	http://ifugonnago.site/index.php
URL	http://paydoor.space/index.php
URL	http://430lodsposlok.online/index.php
URL	http://linkonbak.site/index.php
URL	http://430lodsposlok.site/index.php
URL	http://dontbeburrow.space/index.php
URL	http://430lodsposlok.monster/index.php
URL	http://430lodsposlok.store/index.php
URL	http://luckydaddy.club/index.php
URL	http://metropolibit.monster/index.php
URL	http://inpriorityfit.site/index.php
URL	http://maskofmistery.icu/index.php
DOMAIN	stataready.icu
DOMAIN	bolshebolshezolota.club
DOMAIN	luckydaddy.xyz
DOMAIN	adamantbarbellmethod.com
DOMAIN	userauto.space
DOMAIN	22231jssdszs.fun
DOMAIN	hssubnsx.xyz
DOMAIN	dshdh377dsj.fun

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	10213
V3 DAT (Endpoint Security)	4665

Detection Summary

IOC	Scanner	Detection
DF3E587781523F2B9A2080CAA9856D52B103302EBF311BBFEEA54ACB89F4B90D	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
1109F4F612577BA61A8437309FD8BBD164D942090A10D490D6339F6FFB05F2CF	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
D06EA637979440EDF76A679C0E8608E00DAE877BFC10E642A4D9D509BE2BB2A9	AVEngine V2	PWS-FDGP!3C3E5F119519
	AVEngine V3	PWS-FDGP!3C3E5F119519
	JTI (ATP Rules)	JTI/Suspect.196612!3c3e5f119519
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EA3D8E8C07E87FAB40FC0E30DAEA0307C1F0119C6B63A50759625A1EDB777A58	AVEngine V2	AutoIt/Cybergate.a
	AVEngine V3	AutoIt/Cybergate.a
	JTI (ATP Rules)	JTI/Suspect.196612!ebf1d9fce1d7
	RP Static	Real Protect-PENG4!EBF1D9FCE1D7
	RP Dynamic	-

IOC	Scanner	Detection
933AC399735239F00815637995C752757D867CC601B80274E62EF613C54CD510	AVEngine V2	PWS-FDGP!29B99F2547AA
	AVEngine V3	PWS-FDGP!29B99F2547AA
	JTI (ATP Rules)	JTI/Suspect.196612!29b99f2547aa
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C997D6CA731762B6EB874296B8DEA931095BB5D59F6E2195F02CFAD246994A07	AVEngine V2	GenericRXJC-NH!38BB4505707F
	AVEngine V3	GenericRXJC-NH!38BB4505707F
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
794833762B3A94A9B1E88FFB915352823B7192255AA7AC86BBE9F93A64395854	AVEngine V2	Generictrojan.sr
	AVEngine V3	Generictrojan.sr
	JTI (ATP Rules)	JTI/Suspect.196612!e988d1994581
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
13CE97767C92B0F048B0CB4BF55CE8E928A77DC209C428B02DE0A890F8F1EC13	AVEngine V2	AutoIt/Cybergate.a
	AVEngine V3	AutoIt/Cybergate.a
	JTI (ATP Rules)	JTI/Suspect.196612!a001a93370e1
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A3B5DA275B97840A1E9E5F553D638BFB8E095102EDD305008CA2875294B4DEB1	AVEngine V2	PWS-FDGP!DD350BC940B7
	AVEngine V3	PWS-FDGP!DD350BC940B7
	JTI (ATP Rules)	JTI/Suspect.196612!dd350bc940b7
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
42178057B6914172E9101DDD265D88501E4518A92E854AD2EF6E8401D3BDBD15	AVEngine V2	PWS-FDGP!E470145BBC91
	AVEngine V3	PWS-FDGP!E470145BBC91
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
A70525F4AAF688588A65CB60FB18F9CC69B895D12DA87CD39BA58F17DB37D531	AVEngine V2	VBS/Downloader.aah
	AVEngine V3	VBS/Downloader.aah
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
0FDE03BD190B9601983C97C4138C5953429A672530F585E53B5725B241C35CBB	AVEngine V2	PWS-FDGP!1E5020675531
	AVEngine V3	PWS-FDGP!1E5020675531
	JTI (ATP Rules)	JTI/Suspect.196612!1e5020675531
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
7D22568C2D8F94852B59F5B01B12289419DC2E617C7977D2262E1061906D3FB3	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C915342445A40722379BF91CF3AE3B846C6CD7BAC069AD1040E2C22ADDBCA1FD	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
65784E672CCAA01697D47837EF036A06E180B394DA60011374A7F4E8F3649492	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!c85f80e8661c
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
6FFC9BACB24EC4484A006DC3183984AF2B7EAEF0244FA5C0E96020081287CA62	AVEngine V2	Generictrojan.sr
	AVEngine V3	Generictrojan.sr
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
9B89464C0543E98D6A96FFAA34B78EF62E48182736482DDD968DB17DC9E3076E	AVEngine V2	PWS-FDGP!F1FA27F78A8D
	AVEngine V3	PWS-FDGP!F1FA27F78A8D
	JTI (ATP Rules)	JTI/Suspect.196612!f1fa27f78a8d
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
BA7BB63B7CF08CFE48AEAD5EC65E81B35B89F4559D16257BA283F77251C15E32	AVEngine V2	PWS-FDGP!B87F4D87DA77
	AVEngine V3	PWS-FDGP!B87F4D87DA77
	JTI (ATP Rules)	JTI/Suspect.196612!b87f4d87da77
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
1C602FC24A980135F9736D55986D694A4B542D69E6CAA225D99C3E9E9C251A1A	AVEngine V2	Remoteadmin.v
	AVEngine V3	Remoteadmin.v
	JTI (ATP Rules)	JTI/Suspect.196612!5e38d0793335
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
28529E85F66CCFCC1B3EF43F37398CAC1716F191775487A99BFE83A66554397A	AVEngine V2	VBS/Downloader.aah
	AVEngine V3	VBS/Downloader.aah
	JTI (ATP Rules)	-
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
68AEBB2F33F1475ABC863495A1BF4A43DE6FA267BEDAD1E64A037F60E3DA707D	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
EF44590FA6F19431C0B2182627F95B6B9568BD2700124BFC7ABE4A979A363BB6	AVEngine V2	AutoIt/Cybergate.a
	AVEngine V3	AutoIt/Cybergate.a
	JTI (ATP Rules)	JTI/Suspect.196612!8ddc4a228141
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
41F9F0DD85B9D1860CBF707471572619218343E1113FA85158F7083D83FCAA0C	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
0CAE9A4E0E73FF75F3FFA7F2D58EE67DF34BC93E976609162CD6381EA9EB6F5B	AVEngine V2	Generictrojan.sr
	AVEngine V3	Generictrojan.sr
	JTI (ATP Rules)	JTI/Suspect.196612!bcf42b43d7ad
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
45B9894E4CAC3C21F28308EE48A0095E9516F8B1C26483C1A58B47A9FBBE27E9	AVEngine V2	GenericRXJC-NH!25504CA8DB14
	AVEngine V3	GenericRXJC-NH!25504CA8DB14
	JTI (ATP Rules)	JTI/Suspect.196612!554aca311aef
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
AC1DF77C0D6D3C35DA7571F49F0F66F144FBCFD442411585E48A82E2F61B1FC1	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e78cece14790
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
ED5ABE5B0B9FB82A455EF0E750F44838E1272E743F079871161A2FA179B081F3	AVEngine V2	GenericRXJC-NH!AC0A1F6E141E
	AVEngine V3	GenericRXJC-NH!AC0A1F6E141E
	JTI (ATP Rules)	JTI/Suspect.196612!e13dbfe3c647
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
E2E66789C7F6627BFB270C609BAE28CD9DF7D369A5BA504DCCC623EB11F9E3F2	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
09158BF9C73F856F8A310FFA7238042D08D3A475EA34FFA6CEE9E88D841C4A7E	AVEngine V2	PWS-FDGP!9A3A57198F75
	AVEngine V3	PWS-FDGP!9A3A57198F75
	JTI (ATP Rules)	JTI/Suspect.196612!9a3a57198f75
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
FBAA11E154C41B8B3E18E6DB587D7C9F612EC7A1983ACA8EC8A9DBB2322A3A9F	AVEngine V2	NSIS/Injector.i
	AVEngine V3	NSIS/Injector.i
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C7E703543814E6B70C0F1B2FE990F0251246DBE7931D7D7EE53B0E559D00E405	AVEngine V2	PWS-FDGP!CF4BACC6AB22
	AVEngine V3	PWS-FDGP!CF4BACC6AB22
	JTI (ATP Rules)	JTI/Suspect.196612!cf4bacc6ab22
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
C8864081450FBF75D2757716EF237E81C4F419C2E2A3E2DEB86432E78412F109	AVEngine V2	PWS-FDGP!CB153264FA48
	AVEngine V3	PWS-FDGP!CB153264FA48
	JTI (ATP Rules)	JTI/Suspect.196612!cb153264fa48
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
F12649DE9F93F6DC29A1C6838779885B733C95D4157F95BC92D3F81F52B41788	AVEngine V2	Remoteadmin.q
	AVEngine V3	Remoteadmin.q
	JTI (ATP Rules)	JTI/Suspect.196612!aad78c0a09b3
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
CB40A5957081D6030E983BCC3E13122660236379858024CFDA932117F8D6125F	AVEngine V2	PWS-FDGP!C83AF25B2EA0
	AVEngine V3	PWS-FDGP!C83AF25B2EA0
	JTI (ATP Rules)	JTI/Suspect.196612!e470145bbc91
	RP Static	-
	RP Dynamic	-

IOC	Scanner	Detection
B6CF71093407D3548E25ADC93CCC867602D5D5860753D480308A81273A483BEE	AVEngine V2	PWS-FDGP!61C54006C5C0
	AVEngine V3	PWS-FDGP!61C54006C5C0
	JTI (ATP Rules)	JTI/Suspect.196612!61c54006c5c0
	RP Static	-
	RP Dynamic	-

Minimum set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:
Rule ID: 4 Use GTI file reputation to identify trusted or malicious files

Endpoint Security - Exploit Prevention:
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 6086 Powershell Command Restriction - Command

Aggressive set of Manual Rules to improve protection to block this campaign
IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Virusscan Enterprise - Access Protection Rules:

Prevent creation of new executable files in the Windows folder
Prevent programs registering as a service

Host Intrusion Prevention:

Rule ID: 6011 Generic Application Invocation Protection
Rule ID: 6135 Unmanaged Powershell Detected
Rule ID: 2806 Attempt to create a hardlink to a file
Rule ID: 6010 Generic Application Hooking Protection
Rule ID: 1020 Windows Agent Shielding - File Access
Rule ID: 1148 CMD Tool Access by a Network Aware Application

Endpoint Security - Access Protection Custom Rules:

Rule: 1

Executables (Include):
?script.exe
Subrules:
Subrule Type: Files
Operations:
create
Targets (Include):
?:\users\*\appdata\roaming\*.exe

VirusScan Enterprise - Access Protection Custom Rules:

Rule: 1

Rule Type: File
Process to include: ?script.exe
File or folder name to block: *\users\*\appdata\roaming\*.exe
File actions to prevent: Create

Affected Products

MVISION Insights

Knowledge Center

MVISION Insights: Magnat campaigns target multiple countries with Malvertising

Environment

Summary

Affected Products

Title

Title

Knowledge Center

MVISION Insights: Magnat campaigns target multiple countries with Malvertising

Environment

Summary

Affected Products

Choose your region

Title

Title