GeoServer RCE Exploited for Espionage, Cryptomining and Botnet Deployment

Threat actors have exploited CVE-2024-36401, a critical unauthenticated remote code execution vulnerability in GeoServer, to deploy espionage tools, cryptocurrency miners and botnet malware. The flaw, rated CVSS 9.8, stems from unsafe XPath evaluation in crafted Open Geospatial Consortium requests. FortiGuard Labs documented campaigns delivering GOREVERSE, the SideWalk Linux backdoor, Condi-related botnet payloads and XMRig miners across multiple regions and sectors. Trend Micro linked exploitation to Earth Baxia, a suspected China-based actor targeting government, telecommunications and energy organizations in Asia-Pacific. That campaign also used spear-phishing, customized Cobalt Strike payloads and the EAGLEDOOR backdoor, with cloud-hosted delivery, DLL side-loading and multiple command-and-control channels.

Subsequent reporting shows continued targeting of exposed GeoServer deployments. AhnLab identified Windows and Linux mining attacks using scripts, self-extracting droppers and custom downloaders, alongside service-based persistence, encrypted in-memory loading and attempts to weaken Windows Defender; however, it did not establish the precise exploitation method in the analyzed incidents. Some activity also included indications of AnyDesk installation and NetCat deployment. In July 2026, SANS recorded a request attributed to the Rondo botnet that attempted to execute a downloader through GeoServer’s Web Feature Service endpoint, but did not confirm successful exploitation or infection. Organizations should prioritize upgrading to a supported, patched GeoServer release, restrict unnecessary external exposure and investigate unexpected services, remote-access tools, mining processes and outbound connections. The original fixes shipped in versions 2.23.6, 2.24.4 and 2.25.2, and CISA added the flaw to its Known Exploited Vulnerabilities catalog in July 2024.