{"id":55539,"date":"2024-03-08T23:11:29","date_gmt":"2024-03-08T23:11:29","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/cybercrime-crew-magnet-goblin-bursts-onto-the-scene-exploiting-ivanti-holes\/"},"modified":"2024-03-08T23:11:29","modified_gmt":"2024-03-08T23:11:29","slug":"cybercrime-crew-magnet-goblin-bursts-onto-the-scene-exploiting-ivanti-holes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cybercrime-crew-magnet-goblin-bursts-onto-the-scene-exploiting-ivanti-holes\/","title":{"rendered":"Cybercrime crew Magnet Goblin bursts onto the scene exploiting Ivanti holes"},"content":{"rendered":"

There’s yet another group of miscreants out there hijacking insecure Ivanti devices: A new, financially motivated gang dubbed Magnet Goblin has emerged from the shadowy digital depths with a knack for rapidly exploiting newly disclosed vulnerabilities before vendors have issued a fix.<\/p>\n

The cybercrime crew has targeted US medical, manufacturing, and energy-sector organizations, according to Check Point, which said it spotted Magnet Goblin abusing security holes in Ivanti’s code<\/a> to break into networks back in January just one day after a proof-of-concept, or PoC, exploit was made public.<\/p>\n

Specifically, the crooks appear to have hit vulnerable Ivanti Connect Secure VPN servers, compromising that equipment and using those footholds to deploy backdoors in victims’ IT environments. Please make sure you’re patched or have mitigations in place, and have checked for indications of compromise, if you’re using Ivanti gear to secure your stuff.<\/p>\n

“We were able to confirm less than 10 organizations in the US, but we assume the real number is much higher,” Sergey Shykevich, threat intelligence manager at Check Point Research, told The Register<\/em>, referring to Magnet Goblin’s victims. <\/p>\n

“We think it is an opportunistic cybercrime group that we currently can’t affiliate to a specific geographical location or a known group,” Shykevich added. “This group was able to utilize the Ivanti exploit extremely quickly, just one day after a POC for it was published.”<\/p>\n