Are Chinese Hackers Exploiting GeoServer Vulnerabilities in Asia-Pacific?

In a growing concern for cybersecurity across the Asia-Pacific region, Chinese hackers are reportedly exploiting vulnerabilities in GeoServer, an open-source Java server designed for geospatial data management. GeoServer, widely used for sharing, processing, and editing geospatial data, has become an attractive target for a serious threat posed by an Advanced Persistent Threat (APT) group identified as “Earth Baxia.” Earth Baxia has been targeting various sectors including government agencies, telecommunications, and energy companies, particularly in countries such as Taiwan, the Philippines, South Korea, Vietnam, and Thailand. The core of this sophisticated attack appears to revolve around a Remote Code Execution (RCE) vulnerability identified as CVE-2024-36401 in GeoServer, which allows these hackers to compromise systems significantly.

Sophisticated Attack Vectors and Tactics

Earth Baxia’s attack methodology includes a detailed and intricate infection chain that showcases the group’s advanced capabilities in cyber espionage. Typically, the attack begins with spear-phishing emails containing malicious Microsoft Script (MSC) files, which act as the initial payload delivery mechanism. Once the target interacts with these files, the hackers deploy additional payloads through renowned cloud services such as Amazon Web Services (AWS) and Aliyun. This phase often includes complex tactics for payload deployment like AppDomainManager injection and a technique known as GrimResource, both of which facilitate the download and execution of malicious content onto the compromised system.

Earth Baxia also employs customized Cobalt Strike components to reinforce their attacks. Notably, they use a shellcode loader referred to as “SWORDLDR” and a novel backdoor named “EAGLEDOOR.” These elements are crucial for maintaining a foothold within the targeted systems. EAGLEDOOR stands out due to its multi-protocol communication capabilities, making it particularly difficult to detect and mitigate. It supports communication over DNS, HTTP, TCP, and even the encrypted messaging service Telegram. EAGLEDOOR’s persistence is largely attributed to DLL side-loading techniques using files named “Systemsetting.dll” and “Systemsetting.exe,” ensuring the malware remains embedded within the system.

Advanced Techniques and Obfuscation

EAGLEDOOR’s sophistication extends beyond its communication capabilities. Its persistence mechanisms and advanced obfuscation techniques illustrate Earth Baxia’s high level of technical acumen. For instance, EAGLEDOOR utilizes API hooking through a file named “Hook.dll” and conducts its primary operations via another file named “Eagle.dll.” By altering standard API behaviors, the malware can effectively conceal its activities. Additionally, sophisticated encryption methods, such as Base64 and AES, are employed to further obfuscate operations and evade traditional cybersecurity defenses, making it challenging for cybersecurity teams to pinpoint and neutralize the threat.

During data exfiltration, Earth Baxia archives the targeted information before uploading it to remote servers using tools like curl.exe. This process ensures that the exfiltrated data remains secure and undetected during transmission. The group has also demonstrated adaptability in their attack strategies by using various initial access methods, including MSC and LNK files, to introduce their full suite of malicious tools. In one notable example, they used the site “Static.krislab.site” to distribute decoy documents and Cobalt Strike components, such as “Edge.exe,” “msedge.dll,” and “Logs.txt,” which were executed via PowerShell commands.

Explore more

UK’s 5G Networks Lag Behind Europe in Quality and Coverage

In 2025, a digital challenge hovers over the UK as the nation grapples with underwhelming 5G network performance compared to its European counterparts. Recent analyses from MedUX, a firm specializing in mobile network assessment, have uncovered significant discrepancies between the UK’s target for 5G accessibility and real-world consumer experiences. While theoretical models predict widespread reach, everyday exchanges suggest a different

Shared 5G Standalone Spectrum – Review

The advent of 5G technology has revolutionized telecommunications by ushering in a new era of connectivity. Among these innovations, shared 5G Standalone (SA) spectrum emerges as a novel approach to address increasing data demands. With mobile data usage anticipated to rise to 54 GB per month by 2030, mainly due to indoor consumption, shared 5G SA spectrum represents a significant

How Does Magnati-RAKBANK Partnership Empower UAE SMEs?

The landscape for small and medium-sized enterprises (SMEs) in the UAE is witnessing a paradigm shift. Facing obstacles in accessing finance, SMEs now have a lifeline through the strategic alliance between Magnati and RAKBANK. This collaboration emerges as a pivotal force in transforming financial accessibility, employing advanced embedded finance services tailored to SMEs’ unique needs. It’s a partnership set to

How Does Azure Revolutionize Digital Transformation?

In today’s fast-paced digital era, businesses must swiftly adapt to remain competitive in the ever-evolving technological landscape. The concept of digital transformation has become essential for organizations seeking to integrate advanced technologies into their operations. One key player facilitating this transformation is Microsoft Azure, a cloud platform that’s enabling businesses across various sectors to modernize, scale, and innovate effectively. Through

Digital Transformation Boosts Efficiency in Water Utilities

In a world where water is increasingly scarce, the urgency for efficient water management has never been greater. The global water utilities sector, responsible for supplying this vital resource, is facing significant challenges. As demand is projected to surpass supply by 40% within the next decade, water utilities worldwide struggle with inefficiencies and high water loss, averaging losses of one-third