Cybercrime crew Magnet Goblin bursts onto the scene exploiting Ivanti holes

Check Point observed a financially motivated group called Magnet Goblin rapidly exploiting newly disclosed Ivanti Connect Secure VPN vulnerabilities (often within one day of PoC release) to compromise US organizations in the medical, manufacturing, and energy sectors. The intrusions involved deploying Linux backdoors (MiniNerbian, NerbianRAT), a JavaScript credential stealer (WARPWIRE), and leveraging legitimate remote admin tools (ScreenConnect, AnyDesk); the group is linked to other edge-product exploits (Qlik Sense) and connections to Cactus ransomware activity.