GeoServer exploitation, federal breach, and monetization activity

**CVE-2024-36401** is a critical **GeoServer** remote code execution vulnerability that was patched on **June 18, 2024** and later **actively exploited** against exposed servers. In a later **CISA** disclosure, attackers breached a **large unnamed FCEB agency** by abusing the flaw in **GeoServer**, then used **Burp Suite** for scanning, accessed a second GeoServer, **moved laterally to two other servers**, and dropped web shells including **China Chopper**. The agency’s delayed remediation, weak incident response, and limited logging left the activity undetected for **three weeks** and complicated containment.

An active **GeoServer** exploitation campaign is using **CVE-2024-36401** to turn exposed servers into infrastructure for **bandwidth sharing** and other passive-income abuse. The activity has been seen against **internet-facing GeoServer instances** since **early March 2025**, increasing the risk that unpatched deployments are being quietly repurposed. The campaign matters because the payloads are delivered from **adversary-controlled servers** and are designed to stay low-profile while monetizing compromised systems.

**CISA** added **CVE-2025-58360** in **OSGeo GeoServer** to the **KEV catalog** after evidence of **active exploitation** in the wild. The flaw is an **unauthenticated XXE** issue affecting **all versions through 2.25.5** and **2.26.0 through 2.26.1**, with fixes now available in later releases. Successful abuse could enable **arbitrary file access**, **SSRF**, or **DoS** against exposed GeoServer instances.

An **unnamed U.S. federal civilian executive branch agency** was breached after attackers exploited **CVE-2024-36401** in **GeoServer**, then used the foothold to move laterally to a **web server** and **SQL server**. **CISA** said the activity remained undetected for **three weeks** and that the agency's weak incident response, logging, and patching slowed containment. The attackers used **Burp Suite** for scanning, **China Chopper** web shells, **brute force** password attacks, and **Stowaway** for C2 traffic.