Tuesday, October 15, 2024
HomeCyber Security NewsMagnet-Goblin Hackers Attack Public Services Using 1-Day Exploits

Magnet-Goblin Hackers Attack Public Services Using 1-Day Exploits

Published on

Malware protection

A new threat actor, Magnet Goblin, emerged by rapidly exploiting recently disclosed vulnerabilities (CVE-2023-46805 & CVE-2023-21887) in Ivanti Connect Secure VPN, which allowed them to deploy custom Linux backdoors on vulnerable systems.

Magnet Goblin has a history of targeting platforms like Magento, Qlik Sense, and potentially Apache ActiveMQ, using similar tactics to gain financial advantage.

Their strategy involves quickly adopting newly discovered vulnerabilities to establish backdoors on compromised systems. These backdoors enable them to steal data or gain unauthorized access by exploiting one-day vulnerabilities for potential financial gain.

- Advertisement - SIEM as a Service

A financially driven cybercriminal group exploits weaknesses in edge devices and public servers.

  • Magento – CVE-2022-24086
  • Qlik Sense – CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365
  • Ivanti Connect Secure – CVE-2023-46805 and CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893.

Their custom-made Nerbian malware family includes tools like NerbianRAT (cross-platform) for complete remote control and MiniNerbian (Linux-specific) for maintaining backdoor access.

Past Magnet Goblin campaigns.

Rapid Exploitation of Public Servers with Custom Malware

An investigation of recent Ivanti exploits revealed downloads linked to a Linux variant of NerbianRAT malware, which fetched various malicious payloads from an attacker-controlled server, including a WARPWIRE JS stealer and Ligolo tunneling tool.

After finding vulnerabilities, the attackers’ malicious servers allowed them to retrieve a fresh version of the NerbianRAT malware. 

  • http://94.156.71[.]115/lxrt
  • http://91.92.240[.]113/aparche2
  • http://45.9.149[.]215/aparche2

It uses a custom WARPWIRE variant alongside NerbianRAT, which steals VPN credentials and sends them to a compromised Magento server. This highlights the threat actor’s multi-tool approach.

                                                 WARPWIRE variant used by Magnet Goblin.

Analysis of the Infrastructure:

Beyond the Linux tools mentioned above, Magnet Goblin’s arsenal also extends to Windows. They leverage legitimate tools like ScreenConnect (downloaded from their server) and AnyDesk for remote access. 

Interestingly, the IP used for ScreenConnect downloads aligns with the one observed on compromised Qlik Sense servers, suggesting a wider exploitation attempt.

Evidence suggests possible connections to both Cactus ransomware (based on observed tactics) and Apache ActiveMQ vulnerabilities (based on downloaded files). 

Compromised Magento servers were used to deploy BAT scripts that downloaded and executed AnyDesk, further showcasing the diverse tools used by this threat actor.

Batch script deploying AnyDesk, utilizing a hacked Magento server.

NerbianRAT is a Linux backdoor first observed in May 2022. It is poorly obfuscated and lacks anti-analysis techniques. Upon execution, it collects basic information about the infected machine and generates a unique bot ID. 

Then, it decrypts its working directory and searches for a configuration file containing various settings, including the C2 server address, working hours, and a public key for encryption.

It communicates with its C2 server using raw TCP sockets and a custom protocol, and data is encrypted using AES or RSA, depending on the type of data transmitted. 

The backdoor operates in two primary states: during working hours (as defined in the configuration), it sends data to the C2 server and awaits instructions, while outside of working hours, it can still send “ping” messages to the server.

MiniNerbian simplifies NerbianRAT for command execution and sends HTTP POST requests to its C2 server to execute system commands, change its internal time flag, and update configuration.

Code similarity between NerbianRAT and MiniNerbian.

In cybersecurity, distinguishing specific activities amid widespread opportunistic exploitation attacks is challenging due to the technical and attribution complexities.

Defenders often prioritize response and mitigation, sometimes missing the activities of unique actors who exploit these situations.

A recent example is the Ivanti Secure Connect VPN exploitation by various threat actors, including Magnet Goblin, who exploited the vulnerability before appliances were patched.

Motivated by financial gains, Magnet Goblin quickly utilized one-day vulnerabilities to deploy custom Linux malware, such as NerbianRAT and MiniNerbian, primarily targeting unprotected edge devices.

IOCs :

TypeValueDescription
IP91.92.240[.]113Magnet Goblin Infra
IP45.9.149[.]215Magnet Goblin Infra
IP94.156.71[.]115Magnet Goblin Infra
URLhttp://91.92.240[.]113/auth.jsMagnet Goblin Infra
URLhttp://91.92.240[.]113/login.cgiMagnet Goblin Infra
URLhttp://91.92.240[.]113/aparche2Magnet Goblin Infra
URLhttp://91.92.240[.]113/agentMagnet Goblin Infra
URLhttp://45.9.149[.]215/aparche2Magnet Goblin Infra
URLhttp://45.9.149[.]215/agentMagnet Goblin Infra
URLhttp://94.156.71[.]115/lxrtMagnet Goblin Infra
URLhttp://94.156.71[.]115/agentMagnet Goblin Infra
URLhttp://94.156.71[.]115/instali.ps1Magnet Goblin Infra
URLhttp://94.156.71[.]115/ligocert.datMagnet Goblin Infra
URLhttp://94.156.71[.]115/angel.datMagnet Goblin Infra
URLhttp://94.156.71[.]115/windows.xmlMagnet Goblin Infra
URLhttp://94.156.71[.]115/instal1.ps1Magnet Goblin Infra
URLhttp://94.156.71[.]115/Maintenance.ps1Magnet Goblin Infra
URLhttp://94.156.71[.]115/baba.datMagnet Goblin Infra
URL**http://**oncloud-analytics[.]com/files/mg/elf/RT1.50.pngMagnet Goblin Infra
URLhttp://cloudflareaddons[.]com/assets/img/Image_Slider15.1.pngMagnet Goblin Infra
Domainmailchimp-addons[.]comMiniNerbian C2
Domainallsecurehosting[.]comMiniNerbian C2
Domaindev-clientservice[.]comMiniNerbian C2
Domainoncloud-analytics[.]comMiniNerbian C2
Domaincloudflareaddons[.]comMiniNerbian C2
Domaintextsmsonline[.]comMiniNerbian C2
Domainproreceive[.]comMiniNerbian C2
IP172.86.66[.]165NerbianRAT C2
IP45.153.240[.]73NerbianRAT C2
SHA256027d03679f7279a2c505f0677568972d30bc27daf43033a463fafeee0d7234f6NerbianRAT
SHA2569cb6dc863e56316364c7c1e51f74ca991d734dacef9029337ddec5ca684c1106NerbianRAT
SHA2569d11c3cf10b20ff5b3e541147f9a965a4e66ed863803c54d93ba8a07c4aa7e50NerbianRAT
SHA256d3fbae7eb3d38159913c7e9f4c627149df1882b57998c8acaac5904710be2236MiniNerbian
SHA256df91410df516e2bddfd3f6815b3b4039bf67a76f20aecabccffb152e5d6975efMiniNerbian
SHA25699fd61ba93497214ac56d8a0e65203647a2bc383a2ca2716015b3014a7e0f84dMiniNerbian
SHA2569ff0dcce930bb690c897260a0c5aaa928955f4ffba080c580c13a32a48037cf7MiniNerbian
SHA2563367a4c8bd2bcd0973f3cb22aa2cb3f90ce2125107f9df2935831419444d5276MiniNerbian
SHA256f23307f1c286143b974843da20c257901cf4be372ea21d1bb5dea523a7e2785dMiniNerbian
SHA256f1e7c1fc06bf0ea40986aa20e774d6b85c526c59046c452d98e48fe1e331ee4cMiniNerbian
SHA256926aeb3fda8142a6de8bc6c26bc00e32abc603c21acd0f9b572ec0484115bb89MiniNerbian
SHA256894ab5d563172787b052f3fea17bf7d51ca8e015b0f873a893af17f47b358efeMiniNerbian
SHA2561079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548WARPWIRE
SHA256e134e053a80303d1fde769e50c2557ade0852fa827bed9199e52f67bac0d9efcWARPWIRE
URLwww.fernandestechnical[.]com/pub/health_check.phpCompromised Server
URLbiondocenere[.]com/pub/health_check.phpCompromised Server
URL****www.miltonhouse[.]nl/pub/opt/processor.phpCompromised Server
URLhttps://theroots[.]in/pub/media/avatar/223sam.jpgCompromised Server
SHA2567967def86776f36ab6a663850120c5c70f397dd3834f11ba7a077205d37b117fOther: Tools and scripts
SHA2569895286973617a79e2b19f2919190a6ec9afc07a9e87af3557f3d76b252292dfOther: Tools and scripts
SHA256bd9edc3bf3d45e3cdf5236e8f8cd57a95ca3b41f61e4cd5c6c0404a83519058eOther: Tools and scripts
SHA256b35f11d4f54b8941d4f1c5b49101b67b563511a55351e10ad4ede17403529c16Other: Tools and scripts
SHA2567b1d1e639d1994c6235d16a7ac583e583687660d7054a2a245dd18f24d10b675Other: Tools and scripts
SHA2568fe1ed1e34e8758a92c8d024d73c434665a03e94e5eb972c68dd661c5e252469Other: Tools and scripts
SHA256fa317b071da64e3ee18d82d3a6a216596f2b4bca5f4d3277a091a137d6a21c45Other: Tools and scripts

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...

OilRig Hackers Exploiting Microsoft Exchange Server To Steal Login Details

Earth Simnavaz, an Iranian state-sponsored cyber espionage group, has recently intensified its attacks on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Hackers Allegedly Selling Data Stolen from Cisco

A group of hackers reportedly sells sensitive data stolen from Cisco Systems, Inc.The...

Fortigate SSLVPN Vulnerability Exploited in the Wild

A critical vulnerability in Fortinet's FortiGate SSLVPN appliances, CVE-2024-23113, has been actively exploited in...

Splunk Enterprise Vulnerabilities let Attackers Execute Remote Code

Splunk has disclosed multiple vulnerabilities affecting its Enterprise product, which could allow attackers to...