China's 'Earth Baxia' Spies Exploit Geoserver to Target APAC Orgs

Trend Micro warns of a China-linked APT dubbed Earth Baxia conducting espionage across the Asia-Pacific by spear-phishing and exploiting GeoServer (CVE-2024-36401) to install Cobalt Strike or a custom EagleDoor backdoor; targets include government, military, energy, and telecom sectors and the group leverages techniques such as GrimResource and AppDomainManager injection with infrastructure largely hosted in China.