Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth

Palo Alto Networks Unit 42 observed an active campaign (since March 2025) exploiting CVE-2024-36401 in GeoServer to achieve remote code execution and deploy scripts/executables that install or misuse legitimate SDKs and apps to covertly monetize victims' bandwidth (residential proxy/network sharing). The report details exploit code flow through JXPath, infrastructure shifts (notable distribution hosts 37.187.74.75 and 64.226.112.52 and exploit source 185.246.84.189), numerous IOCs (IPs, ports, URLs, SHA256 hashes), and recommends patching and using detections/controls (Threat Prevention, WildFire, XDR) to mitigate the threat.