YOUR CONNECTION, THEIR CASH: THREAT ACTORS MISUSE SDKS TO SELL YOUR BANDWIDTH

Summary from the TLDR InfoSec newsletter

Attackers have been exploiting CVE-2024-36401 in GeoServer to deploy legitimate SDKs and bandwidth-sharing apps that monetize victims' internet connections, operating stealthily with minimal resource consumption while generating passive income through residential proxy networks. The campaign uses Dart-compiled executables distributed via transfer. To maintain persistence, attackers are targeting over 7,000 exposed GeoServer instances globally, while evading detection by shifting their infrastructure with different IP addresses. The exploit leverages JXPath extension functions to achieve remote code execution, allowing attackers to download and execute monetization payloads that masquerade as legitimate passive income services.