Magnet Goblin Hacker Group Leveraging 1-Day Exploits to Deploy Nerbian RAT

Magnet Goblin is a financially motivated threat actor that rapidly weaponizes one-day vulnerabilities against public-facing servers and edge devices (e.g., Ivanti Connect Secure, Magento, Qlik Sense) to gain access and deploy Linux and cross-platform remote access trojans (Nerbian RAT and MiniNerbian). The group also uses credential stealers (WARPWIRE), tunneling tools (Ligolo), and legitimate remote desktop software to maintain access and exfiltrate data, with exploit deployment observed within a day of public proof-of-concept releases.