New Magnet Goblin cybercrime crew is targeting Windows and Linux devices with all-new malware


Cybersecurity researchers from Check Point haev discovered a new hacking collective deploying all-new malware on Windows and Linux devices.
Check Point says the previously-unknown group, dubbed Magnet Goblin, was leveraging 1-day vulnerabilities – flaws for which a patch was only recently released. In some instances, the group was leveraging flaws just a day after someone releases a proof-of-concept (PoC).
Some of the flaws Magnet Goblin was abusing includes those found in Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, CVE-2024-21893, Apache ActiveMQ, ConnectWise ScreenConnect, Qlik Sense (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365), and Magento (CVE-2022-24086).
Securing the website
The group used the flaws to deploy unique malware, for both Windows and Linux, such as NerbianRAT, MiniNerbian, and WARPWIRE. While NerbianRAT isn’t exactly new, the researchers added that a Linux version only started circulating in mid-2022.
Here is a full list of the malware’s capabilities:
Request more actions from the command & control server (C2)
Execute a Linux command in a new thread
Send command result and clean the file; stop any running commands
Execute a Linux command immediately
Do nothing
Modify connection interval
Adjust and save worktime settings
Return idle timings, config, or command results
Update a specific config variable
Refresh command buffer for C2 execution commands
As for MiniNerbian, as the name suggests, it’s a stripped-down version of NerbianRAT, capable of:
Executing C2’s commands and returning results
Updating activity schedule (full day or specific hours)
Updating configuration
Magnet Goblin is described as a financially-motivated actor, meaning it’s not state-sponsored and its goals aren’t aligned with any nation-state. It mostly targets healthcare, manufacturing, and energy organizations in the US, Check Point says. Speaking to The Register, Sergey Shykevich, Check Point’s threat intelligence manager, said the researchers found fewer than 10 organizations in the US that fell victim to Magnet Goblin. “But we assume the real number is much higher,” he added.
“We think it is an opportunistic cybercrime group that we currently can’t affiliate to a specific geographical location or a known group,” Shykevich added. “This group was able to utilize the Ivanti exploit extremely quickly, just one day after a POC for it was published.”
More from TechRadar Pro
Cybersecurity researchers from Check Point haev discovered a new hacking collective deploying all-new malware on Windows and Linux devices. Check Point says the previously-unknown group, dubbed Magnet Goblin, was leveraging 1-day vulnerabilities – flaws for which a patch was only recently released. In some instances, the group was leveraging flaws…
Recent Posts
- China ‘sinks’ 400 servers equivalent to 30,000 gaming PCs as it powers ahead with massive underwater data center project – but I wonder what GPU they use
- SpaceX thinks it knows why Starship exploded on its last test flight
- The rise of the TV monitor: MSI joins the likes of Samsung and LG with a smart monitor that offers Google TV and even a remote control
- What to expect from Amazon’s big Alexa event this week
- Fraudsters seem to target Seagate hard drives in order to pass old, used HDDs as new ones using intricate techniques
Archives
- February 2025
- January 2025
- December 2024
- November 2024
- October 2024
- September 2024
- August 2024
- July 2024
- June 2024
- May 2024
- April 2024
- March 2024
- February 2024
- January 2024
- December 2023
- November 2023
- October 2023
- September 2023
- August 2023
- July 2023
- June 2023
- May 2023
- April 2023
- March 2023
- February 2023
- January 2023
- December 2022
- November 2022
- October 2022
- September 2022
- August 2022
- July 2022
- June 2022
- May 2022
- April 2022
- March 2022
- February 2022
- January 2022
- December 2021
- November 2021
- October 2021
- September 2021
- August 2021
- July 2021
- June 2021
- May 2021
- April 2021
- March 2021
- February 2021
- January 2021
- December 2020
- November 2020
- October 2020
- September 2020
- August 2020
- July 2020
- June 2020
- May 2020
- April 2020
- March 2020
- February 2020
- January 2020
- December 2019
- November 2019
- September 2018
- October 2017
- December 2011
- August 2010