Geo Server Exploits, Polar Edge, and Gayfemboy Push Cybercrime Beyond Traditional Botnets
Summary: Researchers at Palo Alto Networks Unit 42 reported that attackers have been probing internet-exposed GeoServer instances since at least early March 2025, exploiting CVE-2024-36401 (CVSS 9.8) to drop Dart-written executables that quietly share victims' bandwidth through legitimate passive-income SDKs, with telemetry showing over 7,100 exposed GeoServer instances across 99 countries. Separately, Censys detailed the PolarEdge IoT botnet, which drops an Mbed TLS backdoor on enterprise firewalls, routers, IP cameras, and VoIP phones and had about 40,000 active devices as of this month, while Fortinet described a Mirai variant called gayfemboy targeting DrayTek, TP-Link, Raisecom, and Cisco products, and CloudSEK tied TA-NATALSTATUS to cryptojacking of unauthenticated Redis servers on port 6379.
What you should know: Unit 42 notes the GeoServer campaign favors stealthy, persistent monetization over aggressive exploitation, so the payoff is bandwidth theft that raises no red flags rather than a noisy intrusion. PolarEdge's roughly 40,000 devices, more than 70% concentrated in South Korea, the United States, Hong Kong, Sweden, and Canada, relay traffic in the background while the device keeps working normally, which is why owners and ISPs are unlikely to notice.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-36401
- Related
- CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability Known Exploited Vulnerabilities · Jul 15, 2024