Apache ActiveMQ OpenWire Deserialization RCE (CVE-2023-46604) — 6,400 Brokers Actively Exploited by HelloKitty, Kinsing, TellYouThePass and Andariel (Lazarus) — Threadlinqs Intelligence
As of 2026-05-30, Apache ActiveMQ OpenWire Deserialization RCE (CVE-2023-46604) — 6,400 Brokers Actively Exploited by HelloKitty, Kinsing, TellYouThePass and Andariel (Lazarus) is a critical-severity vulnerability threat attributed to HelloKitty (Mixed: criminal (HelloKitty/Kinsing/TellYouThePass) and state-aligned DPRK (Andariel)), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 32 indicators of compromise.
Threat ID: TL-2026-0404 · Severity: CRITICAL · CVSS: 10 · Status: ACTIVE · Category: VULNERABILITY
Attribution: HelloKitty · Mixed: criminal (HelloKitty/Kinsing/TellYouThePass) and state-aligned DPRK (Andariel) · FINANCIAL
CVE-2023-46604 is a CVSS 10.0 unauthenticated remote code execution vulnerability in the OpenWire protocol marshaller of Apache ActiveMQ (and the Legacy OpenWire Module) that lets a network attacker
## Overview
CVE-2023-46604 is an insecure-deserialization flaw in Apache ActiveMQ's OpenWire wire protocol, rated CVSS v3.1 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). It was disclosed by Apache on 2023-10-27 and added to the CISA Known Exploited Vulnerabilities catalog on 2023-11-02 with a federal remediation deadline of 2023-11-23. Mass exploitation began the same week as disclosure and has never meaningfully subsided — Shadowserver's 2026-04-20 scan found roughly 6,400 unpatched brokers still reachable on the public internet, a headline statistic that prompted this re-hunt.
## Root Cause
The defect lives in `org.apache.activemq.openwire.v12.BaseDataStreamMarshaller.createThrowable(String className, String message)`. When an OpenWire peer receives an `ExceptionResponse` command (data type 31) the marshaller reads the attacker-controlled `className` and calls `Class.forName(className).getConstructor(String.class).newInstance(message)`. There is no allow-list, no interface check, and no validation that the class actually extends `java.lang.Throwable` — any class with a public single-arg `String` constructor that can be reached on the classpath will be loaded and instantiated.
Because ActiveMQ ships with Spring on the classpath, attackers universally abuse `org.springframework.context.support.ClassPathXmlApplicationContext`. Its `String` constructor treats the argument as a URL to a Spring XML bean definition, fetches it, and instantiates every bean declared inside — typically a `java.lang.ProcessBuilder` bean whose `start()` method is invoked via Spring's `method-invoking-factory-bean` pattern, yielding arbitrary OS command execution as the ActiveMQ service user (often root on Linux, LOCAL SYSTEM or a dedicated service account on Windows).
## Exploitation Chain
1. Attacker stands up an HTTP(S) listener hosting a malicious `poc.xml` Spring bean definition.
2. Attacker opens a raw TCP socket to TCP/61616 (default OpenWire) on the victim broker.
3. Attacker sends a crafted OpenWire frame with command type `0x1F` (ExceptionResponse), setting the exception class name to `org.springframework.context.support.ClassPathXmlApplicationContext` and the message field to the URL of the attacker-hosted XML.
4. Broker unmarshals the frame, calls `Class.forName(...).getConstructor(String.class).newInstance(url)`, fetches the XML, and instantiates the declared `ProcessBuilder` bean.
5. `ProcessBuilder.start()` executes the attacker's command (PowerShell downloader, bash reverse shell, cmd.exe one-liner, etc.).
6. Payload stages the actor's tooling: HelloKitty ransomware binaries (`dllloader`/`M4.dll`), the Godzilla JSP webshell (`/tmp/M2.png` dropped into the admin webapp), Kinsing XMRig miner, or TellYouThePass Go-based encryptor.
The attack is pre-authentication and single-packet; scanning is as simple as a TCP SYN probe to 61616 followed by an OpenWire `WireFormatInfo` handshake, and mass exploitation scripts fire through the chain in under 250ms per host.
## Observed Campaigns
- **2023-10-27 — HelloKitty ransomware**: Rapid7 MDR observed near-zero-day exploitation within 48 hours of disclosure, dropping `M2.png` and `M4.png` (renamed DLLs) and invoking `rundll32.exe` via MSDTC to load the HelloKitty encryptor. Two ransom notes (`!!!READ ME_FOR_DECRYPT!!!.txt`) across encrypted environments.
- **2023-11 onward — Kinsing**: cryptominer botnet pivoted within days, using the ActiveMQ RCE as a drop-in replacement for Log4Shell in its exploit rotation; payloads include `kinsing` ELF, `kdevtmpfsi` miner, and the Kinsing rootkit.
- **2023-11 — TellYouThePass ransomware**: Go-based cross-platform ransomware delivered via the same ClassPathXmlApplicationContext primitive; Arctic Wolf reported encryption of Linux brokers with `.locked` extension.
- **2023-12 — Andariel (Lazarus subgroup, DPRK)**: IBM X-Force attributed long-dwell intrusions at a Korean healthcare and manufacturing target to Andariel, who used CVE-2023-46604 for initial access
Weaknesses (CWE)
CWE-502, CWE-20, CWE-913, CWE-470
Target sectors: healthcare, manufacturing, financial-services, technology, government, education, energy, telecommunications, retail, transportation, media
Target regions: North America, Europe, Asia-Pacific, South Korea, Japan, Latin America, Middle East
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 32 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2023-46604, T1595, T1590, T1583, T1608, T1587, T1190, T1059, T1059, T1059, T1106