Vulnerabilities in HFS Servers Exploited by Hackers to Distribute Malware and Mine Monero

Malicious actors are actively exploiting CVE-2024-23692 in Rejetto HTTP File Server (HFS) to execute arbitrary commands and compromise servers; observed post-exploitation activity includes deployment of XMRig coinminers, multiple RATs and backdoors (XenoRAT, Gh0stRAT, PlugX) and GoThief for data exfiltration. The vulnerability affects HFS versions up to 2.3m and has been exploited in the wild, prompting advisories to update affected installations and monitor for indicators of compromise.