A new threat actor, Magnet Goblin, emerged by rapidly exploiting recently disclosed vulnerabilities (CVE-2023-46805 & CVE-2023-21887) in Ivanti Connect Secure VPN, which allowed them to deploy custom Linux backdoors on vulnerable systems.
Magnet Goblin has a history of targeting platforms like Magento, Qlik Sense, and potentially Apache ActiveMQ, using similar tactics to gain financial advantage.
Their strategy involves quickly adopting newly discovered vulnerabilities to establish backdoors on compromised systems. These backdoors enable them to steal data or gain unauthorized access by exploiting one-day vulnerabilities for potential financial gain.
A financially driven cybercriminal group exploits weaknesses in edge devices and public servers.
- Magento – CVE-2022-24086
- Qlik Sense – CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365
- Ivanti Connect Secure – CVE-2023-46805 and CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893.
Their custom-made Nerbian malware family includes tools like NerbianRAT (cross-platform) for complete remote control and MiniNerbian (Linux-specific) for maintaining backdoor access.
Past Magnet Goblin campaigns.
Rapid Exploitation of Public Servers with Custom Malware
An investigation of recent Ivanti exploits revealed downloads linked to a Linux variant of NerbianRAT malware, which fetched various malicious payloads from an attacker-controlled server, including a WARPWIRE JS stealer and Ligolo tunneling tool.
After finding vulnerabilities, the attackers’ malicious servers allowed them to retrieve a fresh version of the NerbianRAT malware.
- http://94.156.71[.]115/lxrt
- http://91.92.240[.]113/aparche2
- http://45.9.149[.]215/aparche2
It uses a custom WARPWIRE variant alongside NerbianRAT, which steals VPN credentials and sends them to a compromised Magento server. This highlights the threat actor’s multi-tool approach.
Analysis of the Infrastructure:
Beyond the Linux tools mentioned above, Magnet Goblin’s arsenal also extends to Windows. They leverage legitimate tools like ScreenConnect (downloaded from their server) and AnyDesk for remote access.
Interestingly, the IP used for ScreenConnect downloads aligns with the one observed on compromised Qlik Sense servers, suggesting a wider exploitation attempt.
Evidence suggests possible connections to both Cactus ransomware (based on observed tactics) and Apache ActiveMQ vulnerabilities (based on downloaded files).
Compromised Magento servers were used to deploy BAT scripts that downloaded and executed AnyDesk, further showcasing the diverse tools used by this threat actor.
NerbianRAT is a Linux backdoor first observed in May 2022. It is poorly obfuscated and lacks anti-analysis techniques. Upon execution, it collects basic information about the infected machine and generates a unique bot ID.
Then, it decrypts its working directory and searches for a configuration file containing various settings, including the C2 server address, working hours, and a public key for encryption.
It communicates with its C2 server using raw TCP sockets and a custom protocol, and data is encrypted using AES or RSA, depending on the type of data transmitted.
The backdoor operates in two primary states: during working hours (as defined in the configuration), it sends data to the C2 server and awaits instructions, while outside of working hours, it can still send “ping” messages to the server.
MiniNerbian simplifies NerbianRAT for command execution and sends HTTP POST requests to its C2 server to execute system commands, change its internal time flag, and update configuration.
In cybersecurity, distinguishing specific activities amid widespread opportunistic exploitation attacks is challenging due to the technical and attribution complexities.
Defenders often prioritize response and mitigation, sometimes missing the activities of unique actors who exploit these situations.
A recent example is the Ivanti Secure Connect VPN exploitation by various threat actors, including Magnet Goblin, who exploited the vulnerability before appliances were patched.
Motivated by financial gains, Magnet Goblin quickly utilized one-day vulnerabilities to deploy custom Linux malware, such as NerbianRAT and MiniNerbian, primarily targeting unprotected edge devices.
IOCs :
| Type | Value | Description |
| IP | 91.92.240[.]113 | Magnet Goblin Infra |
| IP | 45.9.149[.]215 | Magnet Goblin Infra |
| IP | 94.156.71[.]115 | Magnet Goblin Infra |
| URL | http://91.92.240[.]113/auth.js | Magnet Goblin Infra |
| URL | http://91.92.240[.]113/login.cgi | Magnet Goblin Infra |
| URL | http://91.92.240[.]113/aparche2 | Magnet Goblin Infra |
| URL | http://91.92.240[.]113/agent | Magnet Goblin Infra |
| URL | http://45.9.149[.]215/aparche2 | Magnet Goblin Infra |
| URL | http://45.9.149[.]215/agent | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/lxrt | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/agent | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/instali.ps1 | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/ligocert.dat | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/angel.dat | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/windows.xml | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/instal1.ps1 | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/Maintenance.ps1 | Magnet Goblin Infra |
| URL | http://94.156.71[.]115/baba.dat | Magnet Goblin Infra |
| URL | **http://**oncloud-analytics[.]com/files/mg/elf/RT1.50.png | Magnet Goblin Infra |
| URL | http://cloudflareaddons[.]com/assets/img/Image_Slider15.1.png | Magnet Goblin Infra |
| Domain | mailchimp-addons[.]com | MiniNerbian C2 |
| Domain | allsecurehosting[.]com | MiniNerbian C2 |
| Domain | dev-clientservice[.]com | MiniNerbian C2 |
| Domain | oncloud-analytics[.]com | MiniNerbian C2 |
| Domain | cloudflareaddons[.]com | MiniNerbian C2 |
| Domain | textsmsonline[.]com | MiniNerbian C2 |
| Domain | proreceive[.]com | MiniNerbian C2 |
| IP | 172.86.66[.]165 | NerbianRAT C2 |
| IP | 45.153.240[.]73 | NerbianRAT C2 |
| SHA256 | 027d03679f7279a2c505f0677568972d30bc27daf43033a463fafeee0d7234f6 | NerbianRAT |
| SHA256 | 9cb6dc863e56316364c7c1e51f74ca991d734dacef9029337ddec5ca684c1106 | NerbianRAT |
| SHA256 | 9d11c3cf10b20ff5b3e541147f9a965a4e66ed863803c54d93ba8a07c4aa7e50 | NerbianRAT |
| SHA256 | d3fbae7eb3d38159913c7e9f4c627149df1882b57998c8acaac5904710be2236 | MiniNerbian |
| SHA256 | df91410df516e2bddfd3f6815b3b4039bf67a76f20aecabccffb152e5d6975ef | MiniNerbian |
| SHA256 | 99fd61ba93497214ac56d8a0e65203647a2bc383a2ca2716015b3014a7e0f84d | MiniNerbian |
| SHA256 | 9ff0dcce930bb690c897260a0c5aaa928955f4ffba080c580c13a32a48037cf7 | MiniNerbian |
| SHA256 | 3367a4c8bd2bcd0973f3cb22aa2cb3f90ce2125107f9df2935831419444d5276 | MiniNerbian |
| SHA256 | f23307f1c286143b974843da20c257901cf4be372ea21d1bb5dea523a7e2785d | MiniNerbian |
| SHA256 | f1e7c1fc06bf0ea40986aa20e774d6b85c526c59046c452d98e48fe1e331ee4c | MiniNerbian |
| SHA256 | 926aeb3fda8142a6de8bc6c26bc00e32abc603c21acd0f9b572ec0484115bb89 | MiniNerbian |
| SHA256 | 894ab5d563172787b052f3fea17bf7d51ca8e015b0f873a893af17f47b358efe | MiniNerbian |
| SHA256 | 1079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548 | WARPWIRE |
| SHA256 | e134e053a80303d1fde769e50c2557ade0852fa827bed9199e52f67bac0d9efc | WARPWIRE |
| URL | www.fernandestechnical[.]com/pub/health_check.php | Compromised Server |
| URL | biondocenere[.]com/pub/health_check.php | Compromised Server |
| URL | ****www.miltonhouse[.]nl/pub/opt/processor.php | Compromised Server |
| URL | https://theroots[.]in/pub/media/avatar/223sam.jpg | Compromised Server |
| SHA256 | 7967def86776f36ab6a663850120c5c70f397dd3834f11ba7a077205d37b117f | Other: Tools and scripts |
| SHA256 | 9895286973617a79e2b19f2919190a6ec9afc07a9e87af3557f3d76b252292df | Other: Tools and scripts |
| SHA256 | bd9edc3bf3d45e3cdf5236e8f8cd57a95ca3b41f61e4cd5c6c0404a83519058e | Other: Tools and scripts |
| SHA256 | b35f11d4f54b8941d4f1c5b49101b67b563511a55351e10ad4ede17403529c16 | Other: Tools and scripts |
| SHA256 | 7b1d1e639d1994c6235d16a7ac583e583687660d7054a2a245dd18f24d10b675 | Other: Tools and scripts |
| SHA256 | 8fe1ed1e34e8758a92c8d024d73c434665a03e94e5eb972c68dd661c5e252469 | Other: Tools and scripts |
| SHA256 | fa317b071da64e3ee18d82d3a6a216596f2b4bca5f4d3277a091a137d6a21c45 | Other: Tools and scripts |
Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.