Apache ActiveMQ RCE Exploited to Deploy LockBit and Linux Malware

Attackers are exploiting Apache ActiveMQ flaw CVE-2023-46604, an unauthenticated remote code execution bug in the OpenWire protocol caused by unsafe deserialization, to gain initial access to exposed brokers. Security reporting tied the vulnerability to real-world intrusions soon after disclosure, and later incidents showed it being used to compromise both Windows- and Linux-based environments. In one campaign, the access was leveraged to deploy LockBit ransomware after attackers obtained RDP access, underscoring how a broker compromise can quickly lead to broader domain or server takeover.

Separate investigations found Linux-focused post-exploitation activity in which intruders used the same ActiveMQ weakness to install a Sliver implant and a newly identified malware family, DripDropper, which relied on an attacker-controlled Dropbox account for command-and-control and persistence actions. Researchers reported attackers modifying SSH settings to enable root access, adding persistence through cron and SSH configuration changes, and even patching the vulnerable ActiveMQ service after entry to block rival attackers and reduce the chance of discovery. Although Apache released fixes in October 2023, vulnerable and delayed-to-patch deployments have remained exposed long enough to support continued exploitation.