Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities

Key Points

• Magnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities in public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN (CVE-2024-21887), the exploit entered the group’s arsenal as fast as within 1 day after a POC for it was published.


• Campaigns that we were able to attribute to this actor targeted Ivanti, Magento, Qlink Sense and possibly Apache ActiveMQ.


• Analysis of the actor’s recent Ivanti …

actor arsenal case connect connect secure cve cve-2024-21887 exploit facing fast infection ivanti ivanti connect secure ivanti connect secure vpn key key points magnet malware analysis poc points public quickly secure vpn servers services threat threat actor vpn vulnerabilities