Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth

    Friday, August 22, 2025 In: Threat Research Print

    Date: 08/22/2025

    Severity: Medium

    Summary

    This report details a stealthy campaign exploiting CVE-2024-36401, a critical RCE vulnerability (CVSS 9.8) in GeoServer, to gain access to victims' machines and monetize their internet bandwidth. Attackers deploy legitimate or modified SDKs to turn compromised systems into residential proxies, mimicking legal monetization practices used by app developers. The campaign is notable for its low resource usage, lack of traditional malware, and focus on covert bandwidth resale. Since March 2025, threat actors have actively scanned for exposed GeoServer instances, highlighting a broad and vulnerable attack surface.

    Indicators of Compromise (IOC) List

    URL/Domain

    http://37.187.74.75:8080/w1wOYGVLEX/a101

    http://37.187.74.75:8080/IyxzymKCp2/a102

    http://37.187.74.75:8080/cE58oqrYGO/a193

    http://37.187.74.75:8080/YDjV1ocro3/a401

    http://37.187.74.75:8080/3g5eBN8nqv/a402

    http://37.187.74.75:8080/JadF0ucQNf/a593

    http://37.187.74.75:8080/Do4YwzvAJN/alog

    http://37.187.74.75:8080/DQ5ydzkPnK/c401

    http://37.187.74.75:8080/a8HejAHngH/c402

    http://37.187.74.75:8080/vLs5vxpDgV/c593

    http://37.187.74.75:8080/KaMJw2fsDW/d101

    http://37.187.74.75:8080/TMuAS1wp8m/d102

    http://37.187.74.75:8080/iKA3jGXk6x/d193

    http://37.187.74.75:8080/fK4SCflkNg/d401

    http://37.187.74.75:8080/Y1WT747MRP/d402

    http://37.187.74.75:8080/H0cwXMzCrJ/d593

    http://37.187.74.75:8080/XA8Dkr1CJ4/dlog

    http://37.187.74.75:8080/52F6SqfuuS/e101

    http://37.187.74.75:8080/7kS5qiHwg8/e102

    http://37.187.74.75:8080/ei0Ul7l75J/e193

    http://37.187.74.75:8080/kGQtGhOpCP/elog

    http://37.187.74.75:8080/wHNOFLazdK/glog

    http://37.187.74.75:8080/wlLiXFNtjU/hlog

    http://37.187.74.75:8080/gmhm4lmSLO/plog

    http://37.187.74.75:8080/QF8plwpY8Y/s401

    http://37.187.74.75:8080/zJ03zmSrz6/s402

    http://37.187.74.75:8080/22mINruojN/s593

    http://37.187.74.75:8080/3pHrSu54Pf/slog

    http://37.187.74.75:8080/vPN5rgRMTz/wlog

    http://37.187.74.75:8080/T8VevroEJT/z401

    http://37.187.74.75:8080/uCX4Nl2Pwu/z402

    http://37.187.74.75:8080/3twwHaJzxo/z593

    http://64.226.112.52:8080/MFTYFuqKGU/a401

    http://64.226.112.52:8080/cxtpjeM3KU/a402

    http://64.226.112.52:8080/XEQS3MTzdS/a593

    http://64.226.112.52:8080/fAFUQgw7Py/c401

    http://64.226.112.52:8080/0rX20C97S6/c402

    http://64.226.112.52:8080/LuoHgydq6F/c593

    http://64.226.112.52:8080/g1Gl1JWEUw/d401

    http://64.226.112.52:8080/AORGz7zIzn/d402

    http://64.226.112.52:8080/rKS64mUmF7/d593

    http://64.226.112.52:8080/vbbdG8dpAw/s401

    http://64.226.112.52:8080/W7lJoMcuOu/s402

    http://64.226.112.52:8080/6mXfFz7ltE/s593

    http://64.226.112.52:8080/YbEYCqCFVl/z401

    http://64.226.112.52:8080/1Vt9KBLEFr/z402

    http://64.226.112.52:8080/09KvYAUSHm/z593

    IP Address

    37.187.74.75

    64.226.112.52

    Hash

    89f5e7d66098ae736c39eb36123adcf55851268973e6614c67e3589e73451b24

6db4b685f413a3e02113677eee10a29c7406414f7f4da611f31d13e3f595f85d

4e4a467abe1478240cd34a1deaef019172b7834ad57d46f89a7c6c357f066fdb

4e40a0df8f4ba4a87ab8fc64950c67f6725a7e8f14a0a84a4ed79b3a8924ba19

663970530e764f91b0be43936331e6c0a93610db6b86c6c4b64de270ae4d4630

7c18fe9da63c86f696f9ad7b5fcc8292cac9d49973ba12050c0a3a18b7bd1cc9

84ee11f40da3538e4601456912c3efa0e92a903948812fd17fe650c5f7ac33ad

0971264967ba8d461ce98f86b90810493c5e22fc80bf61f0d0eb7a2599a7f77a

491f5af9d29f52a6df026159a8ebd27ee6e27151ea78c4782eb05b2c5d39bfc3

a852133ff7f24b14e4224e7052f6d309353b4838fe5f17d25c712d7a1dd6e80a

b66c64ccd7b9c96fad53f6d3aa0441e46eca899ad8d97964573e41c94fccddba

f340abe5689e51cf78b10165cb93ab8a2988d0fedd0e74c74fc23ac2dca93a13

fc28f97f818d07fd8824333de26e5a0ca0d3fe7233d86f7e227e4838cfea0ca4

7c0c69aa0dcfc937c1fef8d42c74f7e46d128898c1d99d3362f2d18397be36ae

33aad585d6280d1921b5f46f8894ee05d426c7751c2133ed5484bf65af587576

2c5581572ec4877df8ec3e5d2b30bfff5718ecd27d8b3dbe2f393aa5821e7ddd

0e2b92991186bc8a817e0187a9b58928969350bc8d8ad7e6b6cd91c185a7e03c

5bc5dfeaeb43fb1e967cad028f8d2c48f5db17ee6c23c383faee74455c2f1f33

8b25144ad17d023f67477be4791db45d9197d7cfb666b3a5ccc1b1c0e4bae3af

8aafb9965e946e5d4be085a1373abc750a1488ff78e6e082cc36ff20ff328465

a13a07d15d94c996d8b7e8ed633073f6a3e2268a8d14363f16ad48160b85df08

cdae958629383c4dba22a115615d8a63211bbccb06335cd1c4b5e2c2aa3fee77

bbdda70f0c4a3de4ec955e134ad46895ac931e21b930837a85633277128ab7d2

4fd789a19db35e054a5135466d610452bea607a11b7ec765b5474847c22e637c

43b49294b778d4489c69922ff3aca27964a04e0f08bcc830108dc83261a0b205

ae706c149497c2fc809682e8827996ea3ceb7bcecddd87be7543d1dca4853470

3fd7794be80782b11a09f51ac8cbf2147e9d79303923f279d610ee45e12506eb

e25d6134c6a0573ded1d340f609dd71d15934ca165ea79d47898aa37a5185415

085da541d7555ac6afcacd5899027c3fa4132c1eccfb3d8223794c4e0e3eb361

2aa6f95dbe8d17e8e70db677808c96ee956c36b7cc8f274435173cfed0b1f5af

2b176eb8afa0b089ee8fb072c68c6fdcfe4b2f034c776cc32064f26c0e6c69a3

915d1bb1000a8726df87e0b15bea77c5476e3ec13c8765b43781d5935f1d2609

fa2687f94955fbdc2c41f1cff8c7df24937aeb942e4d7856bf2ff52ebf2e61aa

663970530e764f91b0be43936331e6c0a93610db6b86c6c4b64de270ae4d4630

e0b886a39cf098a3c7daa021c7af022b0ceb6edcf3fa49e3c3b8f70b843423c2

9515df36a6d16c0a9fcca680d6b181539d80efd4cda85dacbfb30127a7f11736

491f5af9d29f52a6df026159a8ebd27ee6e27151ea78c4782eb05b2c5d39bfc3

b381e8355cf3a432e63064897cc7719e8b9c38e91c6151cd1e7aed4cd219a75b

dec84a568b6393ccd863bb38851a76f54de6f59193660e4b88aa1f941b744469

33aad585d6280d1921b5f46f8894ee05d426c7751c2133ed5484bf65af587576

7620f22a5ed1a8ac2a1da732e55e14a13197b631e5abba6431f88e5cfa3ae2de

3d7ac752bb0d54802f2def38f44e10854f70ab5a9a001b5c39ab0531b9ed74bf

ae706c149497c2fc809682e8827996ea3ceb7bcecddd87be7543d1dca4853470

6dd6751bae92dfa504f0ad5558ab8adfdfba3df5a7f218245627574bfac39f11

357ca4ad31132ad4bd605e3217968819b04d577884a4e9dd760ed0182c4609ed

2b176eb8afa0b089ee8fb072c68c6fdcfe4b2f034c776cc32064f26c0e6c69a3

97c8ec63766ce63b8ace283928922cfceb7c8f3bc72edcbd255e157a1afb15fe

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 : 

    domainname like "http://37.187.74.75:8080/DQ5ydzkPnK/c401" or siteurl like "http://37.187.74.75:8080/DQ5ydzkPnK/c401" or url like "http://37.187.74.75:8080/DQ5ydzkPnK/c401" or domainname like "http://37.187.74.75:8080/IyxzymKCp2/a102" or siteurl like "http://37.187.74.75:8080/IyxzymKCp2/a102" or url like "http://37.187.74.75:8080/IyxzymKCp2/a102" or domainname like "http://37.187.74.75:8080/Do4YwzvAJN/alog" or siteurl like "http://37.187.74.75:8080/Do4YwzvAJN/alog" or url like "http://37.187.74.75:8080/Do4YwzvAJN/alog" or domainname like "http://37.187.74.75:8080/vLs5vxpDgV/c593" or siteurl like "http://37.187.74.75:8080/vLs5vxpDgV/c593" or url like "http://37.187.74.75:8080/vLs5vxpDgV/c593" or domainname like "http://37.187.74.75:8080/iKA3jGXk6x/d193" or siteurl like "http://37.187.74.75:8080/iKA3jGXk6x/d193" or url like "http://37.187.74.75:8080/iKA3jGXk6x/d193" or domainname like "http://37.187.74.75:8080/fK4SCflkNg/d401" or siteurl like "http://37.187.74.75:8080/fK4SCflkNg/d401" or url like "http://37.187.74.75:8080/fK4SCflkNg/d401" or domainname like "http://37.187.74.75:8080/QF8plwpY8Y/s401" or siteurl like "http://37.187.74.75:8080/QF8plwpY8Y/s401" or url like "http://37.187.74.75:8080/QF8plwpY8Y/s401" or domainname like "http://37.187.74.75:8080/kGQtGhOpCP/elog" or siteurl like "http://37.187.74.75:8080/kGQtGhOpCP/elog" or url like "http://37.187.74.75:8080/kGQtGhOpCP/elog" or domainname like "http://37.187.74.75:8080/zJ03zmSrz6/s402" or siteurl like "http://37.187.74.75:8080/zJ03zmSrz6/s402" or url like "http://37.187.74.75:8080/zJ03zmSrz6/s402" or domainname like "http://37.187.74.75:8080/22mINruojN/s593" or siteurl like "http://37.187.74.75:8080/22mINruojN/s593" or url like "http://37.187.74.75:8080/22mINruojN/s593" or domainname like "http://37.187.74.75:8080/3twwHaJzxo/z593" or siteurl like "http://37.187.74.75:8080/3twwHaJzxo/z593" or url like "http://37.187.74.75:8080/3twwHaJzxo/z593" or domainname like "http://37.187.74.75:8080/w1wOYGVLEX/a101" or siteurl like "http://37.187.74.75:8080/w1wOYGVLEX/a101" or url like "http://37.187.74.75:8080/w1wOYGVLEX/a101" or domainname like "http://37.187.74.75:8080/YDjV1ocro3/a401" or siteurl like "http://37.187.74.75:8080/YDjV1ocro3/a401" or url like "http://37.187.74.75:8080/YDjV1ocro3/a401" or domainname like "http://37.187.74.75:8080/wlLiXFNtjU/hlog" or siteurl like "http://37.187.74.75:8080/wlLiXFNtjU/hlog" or url like "http://37.187.74.75:8080/wlLiXFNtjU/hlog" or domainname like "http://37.187.74.75:8080/cE58oqrYGO/a193" or siteurl like "http://37.187.74.75:8080/cE58oqrYGO/a193" or url like "http://37.187.74.75:8080/cE58oqrYGO/a193" or domainname like "http://37.187.74.75:8080/3g5eBN8nqv/a402" or siteurl like "http://37.187.74.75:8080/3g5eBN8nqv/a402" or url like "http://37.187.74.75:8080/3g5eBN8nqv/a402" or domainname like "http://37.187.74.75:8080/gmhm4lmSLO/plog" or siteurl like "http://37.187.74.75:8080/gmhm4lmSLO/plog" or url like "http://37.187.74.75:8080/gmhm4lmSLO/plog"

    Detection Query 2 :

    domainname like "http://37.187.74.75:8080/Y1WT747MRP/d402" or siteurl like "http://37.187.74.75:8080/Y1WT747MRP/d402" or url like "http://37.187.74.75:8080/Y1WT747MRP/d402" or domainname like "http://37.187.74.75:8080/T8VevroEJT/z401" or siteurl like "http://37.187.74.75:8080/T8VevroEJT/z401" or url like "http://37.187.74.75:8080/T8VevroEJT/z401" or domainname like "http://37.187.74.75:8080/3pHrSu54Pf/slog" or siteurl like "http://37.187.74.75:8080/3pHrSu54Pf/slog" or url like "http://37.187.74.75:8080/3pHrSu54Pf/slog" or domainname like "http://37.187.74.75:8080/a8HejAHngH/c402" or siteurl like "http://37.187.74.75:8080/a8HejAHngH/c402" or url like "http://37.187.74.75:8080/a8HejAHngH/c402" or domainname like "http://37.187.74.75:8080/KaMJw2fsDW/d101" or siteurl like "http://37.187.74.75:8080/KaMJw2fsDW/d101" or url like "http://37.187.74.75:8080/KaMJw2fsDW/d101" or domainname like "http://37.187.74.75:8080/H0cwXMzCrJ/d593" or siteurl like "http://37.187.74.75:8080/H0cwXMzCrJ/d593" or url like "http://37.187.74.75:8080/H0cwXMzCrJ/d593" or domainname like "http://37.187.74.75:8080/wHNOFLazdK/glog" or siteurl like "http://37.187.74.75:8080/wHNOFLazdK/glog" or url like "http://37.187.74.75:8080/wHNOFLazdK/glog" or domainname like "http://37.187.74.75:8080/vPN5rgRMTz/wlog" or siteurl like "http://37.187.74.75:8080/vPN5rgRMTz/wlog" or url like "http://37.187.74.75:8080/vPN5rgRMTz/wlog" or domainname like "http://37.187.74.75:8080/52F6SqfuuS/e101" or siteurl like "http://37.187.74.75:8080/52F6SqfuuS/e101" or url like "http://37.187.74.75:8080/52F6SqfuuS/e101" or domainname like "http://37.187.74.75:8080/ei0Ul7l75J/e193" or siteurl like "http://37.187.74.75:8080/ei0Ul7l75J/e193" or url like "http://37.187.74.75:8080/ei0Ul7l75J/e193" or domainname like "http://37.187.74.75:8080/uCX4Nl2Pwu/z402" or siteurl like "http://37.187.74.75:8080/uCX4Nl2Pwu/z402" or url like "http://37.187.74.75:8080/uCX4Nl2Pwu/z402" or domainname like "http://37.187.74.75:8080/TMuAS1wp8m/d102" or siteurl like "http://37.187.74.75:8080/TMuAS1wp8m/d102" or url like "http://37.187.74.75:8080/TMuAS1wp8m/d102" or domainname like "http://37.187.74.75:8080/7kS5qiHwg8/e102" or siteurl like "http://37.187.74.75:8080/7kS5qiHwg8/e102" or url like "http://37.187.74.75:8080/7kS5qiHwg8/e102" or domainname like "http://37.187.74.75:8080/XA8Dkr1CJ4/dlog" or siteurl like "http://37.187.74.75:8080/XA8Dkr1CJ4/dlog" or url like "http://37.187.74.75:8080/XA8Dkr1CJ4/dlog" or domainname like "http://37.187.74.75:8080/JadF0ucQNf/a593" or siteurl like "http://37.187.74.75:8080/JadF0ucQNf/a593" or url like "http://37.187.74.75:8080/JadF0ucQNf/a593" or domainname like "http://64.226.112.52:8080/MFTYFuqKGU/a401" or siteurl like "http://64.226.112.52:8080/MFTYFuqKGU/a401" or url like "http://64.226.112.52:8080/MFTYFuqKGU/a401"

    Detection Query 3 :

    domainname like "http://64.226.112.52:8080/cxtpjeM3KU/a402" or siteurl like "http://64.226.112.52:8080/cxtpjeM3KU/a402" or url like "http://64.226.112.52:8080/cxtpjeM3KU/a402" or domainname like "http://64.226.112.52:8080/XEQS3MTzdS/a593" or siteurl like "http://64.226.112.52:8080/XEQS3MTzdS/a593" or url like "http://64.226.112.52:8080/XEQS3MTzdS/a593" or domainname like "http://64.226.112.52:8080/fAFUQgw7Py/c401" or siteurl like "http://64.226.112.52:8080/fAFUQgw7Py/c401" or url like "http://64.226.112.52:8080/fAFUQgw7Py/c401" or domainname like "http://64.226.112.52:8080/0rX20C97S6/c402" or siteurl like "http://64.226.112.52:8080/0rX20C97S6/c402" or url like "http://64.226.112.52:8080/0rX20C97S6/c402" or domainname like "http://64.226.112.52:8080/LuoHgydq6F/c593" or siteurl like "http://64.226.112.52:8080/LuoHgydq6F/c593" or url like "http://64.226.112.52:8080/LuoHgydq6F/c593" or domainname like "http://64.226.112.52:8080/g1Gl1JWEUw/d401" or siteurl like "http://64.226.112.52:8080/g1Gl1JWEUw/d401" or url like "http://64.226.112.52:8080/g1Gl1JWEUw/d401" or domainname like "http://64.226.112.52:8080/AORGz7zIzn/d402" or siteurl like "http://64.226.112.52:8080/AORGz7zIzn/d402" or url like "http://64.226.112.52:8080/AORGz7zIzn/d402" or domainname like "http://64.226.112.52:8080/rKS64mUmF7/d593" or siteurl like "http://64.226.112.52:8080/rKS64mUmF7/d593" or url like "http://64.226.112.52:8080/rKS64mUmF7/d593" or domainname like "http://64.226.112.52:8080/vbbdG8dpAw/s401" or siteurl like "http://64.226.112.52:8080/vbbdG8dpAw/s401" or url like "http://64.226.112.52:8080/vbbdG8dpAw/s401" or domainname like "http://64.226.112.52:8080/W7lJoMcuOu/s402" or siteurl like "http://64.226.112.52:8080/W7lJoMcuOu/s402" or url like "http://64.226.112.52:8080/W7lJoMcuOu/s402" or domainname like "http://64.226.112.52:8080/6mXfFz7ltE/s593" or siteurl like "http://64.226.112.52:8080/6mXfFz7ltE/s593" or url like "http://64.226.112.52:8080/6mXfFz7ltE/s593" or domainname like "http://64.226.112.52:8080/YbEYCqCFVl/z401" or siteurl like "http://64.226.112.52:8080/YbEYCqCFVl/z401" or url like "http://64.226.112.52:8080/YbEYCqCFVl/z401" or domainname like "http://64.226.112.52:8080/1Vt9KBLEFr/z402" or siteurl like "http://64.226.112.52:8080/1Vt9KBLEFr/z402" or url like "http://64.226.112.52:8080/1Vt9KBLEFr/z402" or domainname like "http://64.226.112.52:8080/09KvYAUSHm/z593" or siteurl like "http://64.226.112.52:8080/09KvYAUSHm/z593" or url like "http://64.226.112.52:8080/09KvYAUSHm/z593"

    Detection Query 4 :

    dstipaddress IN ("37.187.74.75","64.226.112.52") or srcipaddress IN ("37.187.74.75","64.226.112.52")

    Detection Query 5 :

    sha256hash IN ("fa2687f94955fbdc2c41f1cff8c7df24937aeb942e4d7856bf2ff52ebf2e61aa","8aafb9965e946e5d4be085a1373abc750a1488ff78e6e082cc36ff20ff328465","9515df36a6d16c0a9fcca680d6b181539d80efd4cda85dacbfb30127a7f11736","e25d6134c6a0573ded1d340f609dd71d15934ca165ea79d47898aa37a5185415","e0b886a39cf098a3c7daa021c7af022b0ceb6edcf3fa49e3c3b8f70b843423c2","97c8ec63766ce63b8ace283928922cfceb7c8f3bc72edcbd255e157a1afb15fe","8b25144ad17d023f67477be4791db45d9197d7cfb666b3a5ccc1b1c0e4bae3af","4fd789a19db35e054a5135466d610452bea607a11b7ec765b5474847c22e637c","f340abe5689e51cf78b10165cb93ab8a2988d0fedd0e74c74fc23ac2dca93a13","357ca4ad31132ad4bd605e3217968819b04d577884a4e9dd760ed0182c4609ed","2c5581572ec4877df8ec3e5d2b30bfff5718ecd27d8b3dbe2f393aa5821e7ddd","4e40a0df8f4ba4a87ab8fc64950c67f6725a7e8f14a0a84a4ed79b3a8924ba19","cdae958629383c4dba22a115615d8a63211bbccb06335cd1c4b5e2c2aa3fee77","a852133ff7f24b14e4224e7052f6d309353b4838fe5f17d25c712d7a1dd6e80a","915d1bb1000a8726df87e0b15bea77c5476e3ec13c8765b43781d5935f1d2609","33aad585d6280d1921b5f46f8894ee05d426c7751c2133ed5484bf65af587576","2b176eb8afa0b089ee8fb072c68c6fdcfe4b2f034c776cc32064f26c0e6c69a3","dec84a568b6393ccd863bb38851a76f54de6f59193660e4b88aa1f941b744469","6dd6751bae92dfa504f0ad5558ab8adfdfba3df5a7f218245627574bfac39f11","b66c64ccd7b9c96fad53f6d3aa0441e46eca899ad8d97964573e41c94fccddba","ae706c149497c2fc809682e8827996ea3ceb7bcecddd87be7543d1dca4853470","7c18fe9da63c86f696f9ad7b5fcc8292cac9d49973ba12050c0a3a18b7bd1cc9","fc28f97f818d07fd8824333de26e5a0ca0d3fe7233d86f7e227e4838cfea0ca4","89f5e7d66098ae736c39eb36123adcf55851268973e6614c67e3589e73451b24","3fd7794be80782b11a09f51ac8cbf2147e9d79303923f279d610ee45e12506eb","5bc5dfeaeb43fb1e967cad028f8d2c48f5db17ee6c23c383faee74455c2f1f33","0971264967ba8d461ce98f86b90810493c5e22fc80bf61f0d0eb7a2599a7f77a","663970530e764f91b0be43936331e6c0a93610db6b86c6c4b64de270ae4d4630","6db4b685f413a3e02113677eee10a29c7406414f7f4da611f31d13e3f595f85d","4e4a467abe1478240cd34a1deaef019172b7834ad57d46f89a7c6c357f066fdb","bbdda70f0c4a3de4ec955e134ad46895ac931e21b930837a85633277128ab7d2","43b49294b778d4489c69922ff3aca27964a04e0f08bcc830108dc83261a0b205","491f5af9d29f52a6df026159a8ebd27ee6e27151ea78c4782eb05b2c5d39bfc3","7c0c69aa0dcfc937c1fef8d42c74f7e46d128898c1d99d3362f2d18397be36ae","3d7ac752bb0d54802f2def38f44e10854f70ab5a9a001b5c39ab0531b9ed74bf","b381e8355cf3a432e63064897cc7719e8b9c38e91c6151cd1e7aed4cd219a75b","7620f22a5ed1a8ac2a1da732e55e14a13197b631e5abba6431f88e5cfa3ae2de")

    Reference:    

    https://unit42.paloaltonetworks.com/attackers-sell-your-bandwidth-using-sdks/                       


    Tags

    VulnerabilityThreat ActorCVE - 2024GeoServerMisuse SDKs

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2025 by Gurucul - All rights reserved.