Hackers attack HFS servers to drop malware and Monero miners

Researchers observed active exploitation of CVE-2024-23692 in Rejetto HFS 2.3m allowing unauthenticated command execution; attackers harvest system information, add administrative users, terminate the HFS process to lock out others, and deploy miners (XMRig) and multiple remote-access/backdoor malware (XenoRAT, Gh0stRAT, PlugX, GoThief), with at least one campaign linked to LemonDuck and IoCs published by ASEC.