Tag: CVE-2024-36401

4 Attack Reports | 0 Vulnerabilities

Attack reports

Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth

Palo Alto Networks has identified and identified a threat that is exploiting a critical vulnerability in the GeoServer database, which allows criminals to gain passive income from exploiting victims' internet bandwidth and access to their bandwidth.

Published: August 21, 2025

Linked vulnerabilities : CVE-2024-1182 (CVSS 7.0), CVE-2024-7587 (CVSS 7.8), CVE-2024-8299 (CVSS 7.8), CVE-2024-36401, CVE-2025-32433 (CVSS 10.0), CVE-2025-31324 (CVSS 10.0), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 94

CoinMiner Attacks Exploiting GeoServer Vulnerability

A critical remote code execution vulnerability (CVE-2024-36401) in GeoServer has been actively exploited by threat actors to install CoinMiner malware. The attacks target both Windows and Linux environments with unpatched GeoServer installations. In South Korea, attackers exploited the vulnerabilit…

remote code execution

Published: August 8, 2025

Downloadable IOCs: 4

Mozi Resurfaces as Androxgh0st Botnet: Unraveling The Latest Exploitation Wave

The Androxgh0st botnet, active since January 2024, has evolved to incorporate Mozi botnet payloads, expanding its attack surface from web servers to IoT devices. It exploits vulnerabilities in various platforms, including Cisco ASA, Atlassian JIRA, and PHP frameworks, utilizing remote code executio…

credential theft

vulnerability exploitation

remote code execution

persistent access

Published: November 12, 2024

Linked vulnerabilities : CVE-2024-4577 (CVSS 9.8), CVE-2021-41773, CVE-2018-15133, CVE-2017-9841, CVE-2022-1040, CVE-2021-41277, CVE-2018-10562, CVE-2014-2120, CVE-2021-26086, CVE-2024-36401, CVE-2022-21587, CVE-2018-10561, CVE-2023-1389

Downloadable IOCs: 10

AndroxGh0st Malware Integrates Mozi Botnet to Target IoT and Cloud Services

The AndroxGh0st malware has expanded its capabilities by incorporating the Mozi botnet to target IoT devices and cloud services. This Python-based tool, known for attacking Laravel applications, now exploits a wider range of vulnerabilities in internet-facing applications. The malware uses remote c…

remote code execution

credential stealing

Published: November 8, 2024

Downloadable IOCs: 1

Click here to see more Attack Reports