Threat Research

Researchers identified multiple attack campaigns abusing a GeoServer remote code execution flaw (CVE-2024-36401). The attackers indiscriminately scan the internet for exposed and vulnerable GeoServer instances. After gaining access, they install XMRig-based cryptocurrency miners on compromised servers....

Our team recently identified an attack on a misconfigured MS-SQL server involving XiebroC2, an open-source command-and-control (C2) framework similar to CobaltStrike. The attacker exploited weak credentials to gain access and attempted to install various malware, including coin miners and JuicyPotato for privilege escalation....