MAGNET GOBLIN TARGETS PUBLICLY FACING SERVERS USING 1-DAY VULNERABILITIES

Summary from the TLDR InfoSec newsletter

Magnet Goblin is a financially motivated threat group that rapidly exploits 1-day vulnerabilities in internet-facing services. They use an Ivanti VPN exploit discovered within a day of its release. Their arsenal includes NerbianRAT, WARPWIRE, MiniNerbian backdoors, and remote management tools. They have targeted Ivanti, Magento, Qlik Sense, and possibly Apache ActiveMQ in recent campaigns.