Beijing, Sep 23, 2024 —Chinese hackers exploit a critical GeoServer flaw, unleashing EAGLEDOOR malware to target APAC government and energy sectors, raising global cybersecurity alarms.
In a chilling new cyber espionage campaign, Chinese state-backed hackers are exploiting a recently patched flaw in OSGeo GeoServer GeoTools (CVE-2024-36401), targeting government agencies and energy sectors across the Asia-Pacific (APAC) region.
The sophisticated attack, attributed to a group named Earth Baxia, is deploying the previously unknown EAGLEDOOR malware through a multi-stage infection chain. The vulnerability boasts a CVSS score of 9.8, allowing attackers to deliver Cobalt Strike and the EAGLEDOOR backdoor, enabling them to execute Windows commands, exfiltrate sensitive data, and run malicious payloads.
The flaw has already been exploited in major APAC countries like Taiwan, the Philippines, South Korea, and Vietnam. Cybersecurity analyst Ted Lee of Trend Micro said:
The precision of this campaign is concerning. By leveraging spear-phishing and exploiting critical flaws, they’re bypassing sophisticated defenses.
The EAGLEDOOR malware communicates with its command-and-control (C2) server via multiple protocols, including DNS, HTTP, TCP, and Telegram, making it difficult to detect. Using techniques like GrimResource and AppDomainManager injection, the hackers silently download next-stage malware and extract sensitive data.
These actors are relentless, and their adaptability makes them dangerous. They’re weaponizing public cloud services to hide malicious activity.
This alarming campaign underscores the need for robust cybersecurity strategies, particularly in sectors vulnerable to espionage and sabotage. Experts urge organizations to patch vulnerabilities swiftly and monitor their networks closely.
Other News At VPNRanks
- Ivanti Cloud Flaws Open Door to Remote Code Attacks Worldwide
- RansomHub Hacks Tellurian, Steals NDA-Protected Financial Data
- North Korean Hackers Exploit DMARC Flaws in Espionage Blitz
Hey, wait!
Stay informed on the latest privacy updates, cybersecurity insights, and internet freedom news by following VPNRanks news daily! As your primary resource for critical updates in online security, we ensure you’re always in the know. Make VPN Ranks your go-to guide for safeguarding your digital life!
