CISA Shares Lessons Learned from an Incident Response Engagement

Date: 09/24/2025

Severity: Critical 

Summary

During its incident response efforts, determined that cyber threat actors infiltrated the agency’s network on July 11, 2024, by exploiting a critical vulnerability—CVE-2024-36401 [CWE-95: “Eval Injection”]—in a public-facing GeoServer instance (referred to as GeoServer 1). This vulnerability, publicly disclosed on June 30, 2024, enables unauthenticated remote code execution (RCE) on vulnerable GeoServer versions. The attackers leveraged this flaw to deploy open-source tools and scripts, establishing persistent access within the network. Following the compromise of GeoServer 1, the threat actors separately exploited the same vulnerability to gain initial access to a second instance, GeoServer 2, on July 24, 2024. They also moved laterally from GeoServer 1 to other systems, including a web server and a Structured Query Language (SQL) server. On each compromised host, they uploaded or attempted to upload web shells—such as China Chopper—and various scripts intended for remote access, maintaining persistence, executing commands, and escalating privileges. Additionally, the attackers employed "living off the land" (LOTL) techniques to blend in with legitimate system activity.

Indicators of Compromise (IOC) List  

Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

Reference:    

https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-266a