Ankura CTIX FLASH Update - March 12, 2024

Ransomware/Malware Activity

Magnet Goblin Hacker Group Exploits 1-Day Vulnerabilities

Magnet Goblin is a hacker group that appears to be financially motivated and has been in operation since at least January 2022. The group is known for swiftly leveraging newly disclosed vulnerabilities for initial access and for using the Nerbian custom malware family in their attacks. Magnet Goblin has most recently been observed exploiting vulnerabilities in Ivanti Connect Secure VPN and ConnectWise ScreenConnect. The group has also been known to leverage 1-day exploits in Apache ActiveMQ, Qlik Sense, and Magento. Magnet Goblin targets both Windows and Linux systems with two forms of the Nerbian remote access trojan (RAT) as well as a simplified variant dubbed MiniNerbian. The NerbianRAT backdoor collects system information, runs various commands, and communicates with its command-and-control (C2) server over raw sockets. Meanwhile, MiniNerbian uses HTTP for communication