Magnet Goblin, a new hacking group, has surfaced by taking advantage of vulnerabilities in Ivanti Connect Secure VPN that was just made public (CVE-2023-46805 & CVE-2023-21887). It allowed the group to install unique Linux backdoors on susceptible devices. Magnet Goblin is known for employing similar strategies to target & profit from platforms such as Magento, Qlik Sense, etc.

Magnet Goblin’s tactic requires quick utilization of recently identified weaknesses to install backdoors on infected devices. Using these backdoors, the group can financially profit by stealing data or illegally accessing with the one-day vulnerabilities. It’s a financially motivated group of cybercriminals who exploit vulnerabilities in public servers & edge devices.

1. CVE-2022-24086 – Magento.
2. CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365 in Qlik Sense.
3. CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, and CVE-2024-21893 are the Ivanti Connect Secure codes.

Moreover, Magnet uses tools like NerbianRAT (cross-platform) for total remote control and MiniNerbian (Linux-specific) for backdoor access, which is part of their proprietary Nerbian malware family.

Past Magnet Goblin Campaign.

Public Servers’ Rapid Exploitation with Custom Malware

After looking into previous Ivanti exploits, researchers discovered downloads connected to the NerbianRAT malware Linux version. This malware could retrieve several malicious attack components from an attacker’s server. Also, the attackers’ malicious servers allowed them to obtain the malware’s new version once they discovered weaknesses.

1. http://94.156.71[.]115/lxrt
2. http://91.92.240[.]113/aparche2
3. http://45.9.149[.]215/aparche2

It employs NerbianRAT with a customized WARPWIRE variant to get VPN details and commute them to the compromised Magento server. This stresses the utilization of several tools that Magnet Goblin uses.

WARPWIRE Variant which Magnet Goblin Uses.

Infrastructure Analysis:

Magnet Goblin's toolkit is not just limited to Linux; it also includes Windows versions. They use reputable programs like AnyDesk & ScreenConnect, which they download from their official website, to gain remote access. It's interesting to know that the IP addresses used to obtain ScreenConnect content match the ones found on hacked Qlik Sense servers. As a result, it points out a potentially larger exploitation effort.

Based on observed techniques and downloaded files, evidence points to potential connections to both the Cactus ransomware and Apache ActiveMQ vulnerabilities. BAT scripts that downloaded and ran AnyDesk were deployed via compromised Magento servers, demonstrating the wide range of techniques this Magnet Goblin employs.

Batch Script Deploying AnyDesk, Using a Hacked Magento Server.

The Linux backdoor known as “NerbianRAT” was first discovered in May 2022. It is not a counter-analysis technique and is not well disguised. When running, it creates a unique bot ID and gathers basic data about the compromised system. After decrypting the system’s working directory, NerbianRAT looks for a configuration file containing several settings, such as the address of the C2 server and the public key used for encryption.

NerbianRAT uses a unique protocol and raw TCP connections to communicate with its C2 server. Depending on the type of data being transferred, AES or RSA is used for encryption. The backdoor functions in 2 main modes: it transmits information to the C2 server and waits for instructions during business hours, and it may still send "ping" messages to the server after hours.

MiniNerbian makes NerbianRAT easier to use for executing commands. It updates configuration, modifies its internal time flag, and executes system commands by sending HTTP POST requests to its C2 server.

Code similarity between NerbianRAT and MiniNerbian.

The difficulty in identifying particular actions in between opportunistic pervasive exploitation attacks comes from the attributional & technical intricacies involved in cybersecurity. Cybersecurity experts sometimes miss out on the actions of hackers who take advantage of certain circumstances in favor of mitigation & reaction.

A recent example of this is the way that several hacking groups exploited the vulnerability in Ivanti Secure Connect VPN before the appliances were fixed. Driven by greed, Magnet Goblin quickly took advantage of 1-day vulnerabilities to spread specialized Linux malware to mostly targeted vulnerable edge devices.

IOCs:

Join our TTB Community on LinkedIn for more such interesting articles.