CVE-2024-36401 Exploited in Stealthy Bandwidth-Monetization Campaign

Unit 42 reports an active campaign exploiting CVE-2024-36401 (GeoServer Apache Commons JXPath RCE, CVSS 9.8) in which attackers gain remote code execution to deploy lightweight executables and repurposed passive-income SDKs that quietly monetize victims' internet bandwidth; the campaign (tracked across March–April 2025) uses multiple staging servers and Transfer.sh, targets 7,000+ exposed GeoServer instances worldwide, and emphasizes stealth and persistence rather than high-resource malware.