New Magnet Goblin cybercrime crew is targeting Windows and Linux devices with all-new malware

Date:
Mon, 11 Mar 2024 15:07:28 +0000

Description:
The group's location is not known at the time, and it's most likely not state-sponsored.

FULL STORY ======================================================================

Cybersecurity researchers from Check Point haev discovered a new hacking collective deploying all-new malware on Windows and Linux devices.

Check Point says the previously-unknown group, dubbed Magnet Goblin, was leveraging 1-day vulnerabilities - flaws for which a patch was only recently released. In some instances, the group was leveraging flaws just a day after someone releases a proof-of-concept (PoC).

Some of the flaws Magnet Goblin was abusing includes those found in Ivanti Connect Secure (CVE-2023-46805, CVE-2024-21887, CVE-2024-21888, CVE-2024-21893, Apache ActiveMQ, ConnectWise ScreenConnect, Qlik Sense (CVE-2023-41265, CVE-2023-41266, CVE-2023-48365), and Magento (CVE-2022-24086). Securing the website

The group used the flaws to deploy unique malware, for both Windows and
Linux, such as NerbianRAT, MiniNerbian, and WARPWIRE. While NerbianRAT isnt exactly new, the researchers added that a Linux version only started circulating in mid-2022.

Here is a full list of the malwares capabilities:

Request more actions from the command & control server (C2)

Execute a Linux command in a new thread

Send command result and clean the file; stop any running commands

Execute a Linux command immediately

Do nothing

Modify connection interval

Adjust and save worktime settings

Return idle timings, config, or command results

Update a specific config variable

Refresh command buffer for C2 execution commands

As for MiniNerbian, as the name suggests, its a stripped-down version of NerbianRAT, capable of:

Executing C2's commands and returning results

Updating activity schedule (full day or specific hours)

Updating configuration

Magnet Goblin is described as a financially-motivated actor, meaning its not state-sponsored and its goals arent aligned with any nation-state. It mostly targets healthcare, manufacturing, and energy organizations in the US, Check Point says. Speaking to The Register , Sergey Shykevich, Check Points threat intelligence manager, said the researchers found fewer than 10 organizations in the US that fell victim to Magnet Goblin. But we assume the real number is much higher, he added.

"We think it is an opportunistic cybercrime group that we currently can't affiliate to a specific geographical location or a known group," Shykevich added. "This group was able to utilize the Ivanti exploit extremely quickly, just one day after a POC for it was published." More from TechRadar Pro This WordPress plugin vulnerability has put millions of websites at risk Here's a list of the best firewalls around today These are the best endpoint security tools right now



======================================================================
Link to news story: https://www.techradar.com/pro/security/new-magnet-goblin-cybercrime-crew-is-ta rgeting-windows-and-linux-devices-with-all-new-malware


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)