Threat actors are actively exploiting CVE-2023-46604, a critical remote code execution (RCE) vulnerability in Apache ActiveMQ, to gain initial access, move laterally via Remote Desktop Protocol (RDP), and ultimately deploy LockBit ransomware.
Key Attack Details
- Vulnerability Exploited: CVE-2023-46604 (CVSS 10.0) involves insecure deserialization in the OpenWire protocol.
- Initial Access: Attackers send a malicious OpenWire command to trigger the loading of a remote XML configuration file via HTTP, leading to RCE.
- Credential Theft & RDP: Following the initial breach, threat actors use tools like Metasploit and Meterpreter to dump credentials from memory. These are then used to establish RDP sessions for lateral movement.
- Ransomware Deployment: Attackers use the established RDP access to manually drop and execute LockBit ransomware binaries on high-value targets.
- Persistence: Some campaigns utilize tools like FRP (Fast Reverse Proxy) to relay RDP ports to external attacker-controlled servers.
Affected Versions
The vulnerability impacts systems running versions prior to:
- Apache ActiveMQ Classic: 5.15.16, 5.16.7, 5.17.6, and 5.18.3.
- Apache ActiveMQ Artemis: All versions supporting OpenWire.
Mitigation & Recommendations
- Patch Immediately: Update Apache ActiveMQ to the latest secure version (e.g., 5.18.3+ or 6.x).
- Restrict Access: Use firewalls to block external access to the OpenWire port (default 61616).
- Monitor RDP Activity: Track unusual RDP logins, especially those using service accounts.
- Endpoint Protection: Use EDR solutions like VMware Carbon Black to detect and block suspicious binaries.
