GeoServer, Where Various CoinMiner Attacks Occur

**Executive Summary:** ASEC observed multiple threat actors actively exploiting the GeoServer remote code execution vulnerability (CVE-2024-36401) to install XMRig CoinMiner and other malware across Windows and Linux hosts; the report details three main attack patterns (PowerShell/bash execution, certutil RAR SFX droppers, and batch/NSSM-based downloaders), includes persistence and defense-evasion techniques, and provides IOCs (domains, IPs, and file hashes) for detection and mitigation.