Hackers Exploiting GeoServer RCE Vulnerability to Deploy CoinMiner

A critical GeoServer RCE (CVE-2024-36401) is being actively exploited worldwide to deploy XMRig Monero miners and remote access tooling; attackers use PowerShell and Bash scripts to fetch malware, install NetCat reverse shells on Windows, register Cron-based persistence on Linux, and mine to pool.supportxmr.com:443, with documented compromises in South Korea.