Hijacked Connections – How Cybercriminals Profit from Your Bandwidth

Cybercriminals have launched a sophisticated campaign exploiting a critical vulnerability in GeoServer databases to hijack victim machines and monetize their internet bandwidth for passive income.

This stealthy operation, active since March 2025, represents a significant evolution in how adversaries exploit compromised systems for financial gain.

Critical GeoServer Vulnerability Under Active Exploitation

The attackers are exploiting CVE-2024-36401, a critical remote code execution vulnerability in GeoServer geospatial databases with a CVSS score of 9.8.

This vulnerability is now listed in CISA’s Known Exploited Vulnerabilities Catalog, highlighting its severity and active exploitation in the wild.

The vulnerability stems from JXPath query statement injection, where attackers can execute arbitrary code through extension functionality. Specifically, threat actors leverage Standard Extension Functions to invoke methods like getRuntime().exec(), enabling remote code execution on target systems.

The vulnerability affects various Web Feature Service (WFS), Web Map Service (WMS), and Web Processing Service (WPS) requests, including GetFeature, GetPropertyValue, and Execute requests.

Cortex Xpanse telemetry revealed over 7,000 publicly exposed GeoServer instances across 99 countries, with the majority hosted in China. In the first week of May 2025 alone, 3,706 publicly accessible GeoServers were identified, representing a substantial attack surface.

Stealthy Monetization Through Bandwidth Hijacking

The campaign’s primary objective involves deploying legitimate software development kits (SDKs) and modified applications that generate passive income by sharing victims’ network resources through residential proxies.

This approach mimics legitimate monetization strategies used by app developers who prefer SDKs over traditional advertising methods.

The attackers have demonstrated sophisticated tactics across three distinct phases. Initial attacks in March 2025 originated from IP address 108.251.152[.]209, distributing customized executables from 37.187.74[.]75.

When security vendors flagged this infrastructure as malicious on March 24, the threat actors quickly pivoted to new infrastructure at 185.246.84[.]189 and later expanded to 64.226.112[.]52.

The malicious payloads operate with minimal system resource consumption, making detection challenging. Instead of traditional malware distribution, attackers deployed private instances of transfer.sh file-sharing servers to host their payloads.

The executables, compiled using Dart programming language for cross-platform compatibility, interact with legitimate passive income services to monetize victims’ bandwidth.

Technical Analysis and Mitigation

The attack chain involves a two-stage exploitation process. Stage one leverages CVE-2024-36401 to download second-stage payloads, which are then executed through the same vulnerability.

Analysis reveals attackers use both misused legitimate SDKs and modified applications, with binary comparison confirming identical files to official vendor versions.

Organizations should immediately patch GeoServer instances and implement network monitoring for suspicious outbound connections.

Advanced threat prevention systems can detect exploit traffic in real-time, while endpoint detection solutions should monitor for unusual bandwidth consumption patterns indicative of this stealthy monetization scheme.

Indicators of Compromise

IP Addresses and TCP Ports Used for the Campaign Infrastructure

• 37.187.74[.]75:8080
• 64.226.112[.]52:8080

Campaign Artifacts

Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates