Magnet Goblin

Magnet Goblin is a financially motivated cybercrime threat actor known for rapidly exploiting recently disclosed 1-day vulnerabilities in internet-facing enterprise software to compromise public-facing servers. The group has been associated with exploitation of products including Ivanti, Apache ActiveMQ, and Qlik Sense, followed by deployment of custom malware on both Windows and Linux systems. Reported tooling includes the malware families NerbianRAT and MiniNerbian. The actor’s tradecraft emphasizes opportunistic initial access through vulnerability exploitation rather than long-dwell intrusion sets. Its operations have been characterized by fast weaponization of newly available exploits against exposed services, suggesting strong reconnaissance and scanning capability focused on identifying vulnerable edge infrastructure. Post-compromise activity includes malware deployment and broader post-exploitation actions consistent with establishing control over compromised hosts. Magnet Goblin is tracked as a cybercriminal rather than a state-sponsored espionage actor. Available reporting supports financial gain as its dominant motivation. No high-confidence evidence in the supplied facts directly ties the group to ransomware deployment, extortion operations, or a specific country of origin.