Systems run by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) were breached last month by hackers exploiting bugs in Ivanti products.
Ivanti appliances have been under sustained attack this year from multiple threat groups, including at least one espionage cyber gang linked to China.
Since January, the vendor has issued patches for five high- and critical-severity vulnerabilities affecting its Connect Secure, Policy Secure, and Neurons for Zero Trust Access products.
The day before CISA confirmed two of its systems were breached, Check Point researchers identified a new threat group — dubbed Magnet Goblin — as the latest cyber gang observed abusing the bugs to attack Connect Secure appliances.
Affected CISA systems taken offline
“About a month ago CISA identified activity indicating the exploitation of vulnerabilities in Ivanti products the agency uses," a CISA spokesperson said in a statement supplied to media over the weekend.
“The impact was limited to two systems, which we immediately took offline. We continue to upgrade and modernize our systems, and there is no operational impact at this time.”
The breach was first reported by The Record, a news site by cybersecurity firm Recorded Future. Citing a source with knowledge of the situation, The Record said the CISA systems that hackers breached were the Infrastructure Protection (IP) Gateway and the Chemical Security Assessment Tool (CSAT).
The IP Gateway was officially renamed the CISA Gateway in 2020 and is a web portal used to collect, analyze, and disseminate government information about critical infrastructure. Similarly, CSAT is a portal for information about chemical facilities.
CISA declined to confirm or deny whether the two portals were the systems taken offline as a result of the breach.
“This is a reminder that any organization can be affected by a cyber vulnerability and having an incident response plan in place is a necessary component of resilience,” the agency’s spokesperson said.
CISA said organizations should review an advisory it issued with several partner agencies on Feb. 29 regarding the Ivanti vulnerabilities.
The advisory raised concerns that organizations might not detect breaches because threat actors were able to deceive Ivanti’s internal and external Integrity Checker Tool (ICT).
As a result, CISA and its partner agencies said they “strongly urge all organizations to consider the significant risk of adversary access to, and persistence on, Ivanti Connect Secure and Ivanti Policy Secure gateways when determining whether to continue operating these devices in an enterprise environment."
Magnet Goblin latest group to target Ivanti flaws
Meanwhile, Check Point researchers said their tracking of “the recent wave of Ivanti exploitation” resulted in the discovery of a threat actor they called Magnet Goblin, a financially motivated gang adept at leveraging 1-day vulnerabilities — bugs that have been disclosed but not yet patched.
“Magnet Goblin distinguishes itself by its rapid adoption of newly disclosed vulnerabilities, notably targeting platforms such as Ivanti Connect Secure VPN, Magento, Qlik Sense, and possibly Apache ActiveMQ,” the researchers said in a March 8 post.
“The group’s swift maneuvering to incorporate exploits into their arsenal — at times within a day of a proof of concept being published — signifies a profound threat to digital infrastructures worldwide.”
Check Point said the suite of malware used by Magnet Goblin was “as diverse as it is dangerous.” The gang’s “sophisticated” toolkit included NerbianRAT, a cross-platform remote access trojan for Windows and Linux, open-source tunneling tool Ligolo, and WARPWIRE, a JavaScript credential stealer.
“This diverse malware suite enables a wide range of cyber attacks, from data theft to sustained access within compromised networks,” the researchers warned.
