Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth
Summary: Unit 42 detected a campaign exploiting CVE-2024-36401, a critical remote code execution flaw in GeoServer with a CVSS score of 9.8, to deploy legitimate SDKs and modified apps that monetize victims' internet bandwidth through network sharing and residential proxies. Cortex Xpanse telemetry from March and April 2025 found 7,126 publicly exposed GeoServer instances across 99 countries, with the majority hosted in China, and exploit attempts continued from 185.246.84[.]189 as of the report.
What you should know: The attackers use an unmodified, legitimate SDK that is identical to the vendor's official version, so endpoint detection built to flag malicious binaries may pass it through while it quietly sells your bandwidth.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2024-36401
- Related
- Threats Day Bulletin: Rootkit Patch, Federal Breach, One Plus SMS Leak, TikTok Scandal & More Cyber Risks ·CVE-2024-36401: OSGeo Geo Server Geo Tools Eval Injection Vulnerability Known Exploited Vulnerabilities · Jul 15, 2024