Threat reportRansomwareTL-2026-3952
Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit Ransomware
Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit (TL-2026-3952) is a critical-severity ransomware operation scored CVSS 9.8, first published 2026-10-20. It has no confirmed attribution, affects Apache Software Foundation Apache ActiveMQ (activemq-client, references 1 CVE (CVE-2023-46604), maps to 19 MITRE ATT&CK techniques (T1003.001, T1018, T1021.001), and is covered by 9 detection rules and 17 indicators of compromise.
- CVSS
- 9.8/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-3952
- Threat ID
- TL-2026-3952
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 17
Malware and tooling in Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
Malware and tooling: AnyDesk, LockBit, LockBit 3.0 - S1202, Lockbit3, Meterpreter (Android), Advanced IP Scanner, AnyDesk, AnyDesk client ID 1312001388, Metasploit / Meterpreter, Netscan, certutil - S0160, metasploit
How Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit works
The DFIR Report documents an intrusion in which an unattributed actor exploited CVE-2023-46604 in an internet-exposed Apache ActiveMQ server, deployed a Metasploit stager/Meterpreter and AnyDesk, dumped LSASS credentials, moved laterally, and deployed LockBit ransomware built with the leaked LockBit builder. Initial compromise occurred in mid-February 2024, the actor re-exploited the same server 18 days later, and ransomware executed in under 90 minutes from the second access.
Initial access was via CVE-2023-46604, a deserialization flaw (CWE-502) in the Apache ActiveMQ OpenWire protocol marshaller. The actor sent a crafted OpenWire command whose Throwable class-type field caused the broker to instantiate org.springframework.context.support.ClassPathXmlApplicationContext with a URL to an attacker-hosted Spring XML bean configuration. The XML ran OS commands with the ActiveMQ Java process as parent; CertUtil (certutil -urlcache -split -f) downloaded a Metasploit stager (uFSyLszKsuR.exe) to the user's Temp directory. The same technique was used in both intrusion rounds, with only file names changed.
Round one (mid-February 2024): roughly 40 minutes after exploitation the actor ran Metasploit getsystem, which created a service named kesknq executing cmd.exe /c echo kesknq > \\.\pipe\kesknq (named-pipe impersonation). LSASS memory was accessed from injected code (Sysmon GrantedAccess 0x1010, CallTrace UNKNOWN) on four hosts, including one holding a privileged service account. About an hour in, SMB traffic spiked toward other systems, consistent with scanning. AnyDesk was installed with an auto-start service (System Event ID 7045) and logged in from 166.62.100.52 (client ID 1312001388). Event logs were cleared (Event IDs 104 and 1102), a batch file rdp.bat configured RDP firewall rules and port 3389, and SystemSettingsAdminFlows.exe was used to disable Microsoft Defender settings on an Exchange server. On day two the actor ran discovery commands with syntax errors (e.g. netstat -t) and tried to add an already-privileged account to the domain admins group, then lost access.
Round two (18 days later): the actor re-exploited the same ActiveMQ server and reused the privileged service account credentials dumped in round one. Within about 20 minutes they moved laterally using Metasploit remote service execution (obfuscated PowerShell: string concatenation, {0}/{1} placeholders, Base64, Gzip) to domain controllers, dropped a renamed Advanced IP Scanner and netscan.exe, queried net group "domain admins", and RDP'd into backup and file servers (1-10 minutes per host). LockBit binaries LB3_pass.exe and LB3.exe (the latter with a -psex SMB spreader option) were staged in C:\Intel and user Downloads folders, copied over RDP and launched via an injected Winlogon process or Explorer. Ransom notes and desktop wallpaper were changed; the note directs victims to the Session messenger rather than the standard LockBit Tor/TOX infrastructure, which the report treats as evidence of an independent actor using the leaked builder. Defender blocked some Metasploit lateral-movement attempts. No data exfiltration was reported. Time to ransomware was about 419 hours from first access but under 90 minutes from the second access.
MITRE ATT&CK techniques used in TL-2026-3952
Credential Access
Discovery
T1018 Remote System Discovery; T1046 Network Service Discovery; T1087.002 Domain Account
Lateral Movement
T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.001 PowerShell; T1059.003 Windows Command Shell; T1569.002 Service Execution
Privilege Escalation
Initial Access
T1190 Exploit Public-Facing Application
Command and Control
T1219 Remote Access Tools; T1571 Non-Standard Port
Impact
Persistence
defense-impairment
T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs
Affected products and versions in Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
- Apache Software Foundation — Apache ActiveMQ (activemq-client, activemq-openwire-legacy)
Vulnerable versions: before 5.15.16; 5.16.0-5.16.6; 5.17.0-5.17.5; 5.18.0-5.18.2
Fixed in: 5.15.16; 5.16.7; 5.17.6; 5.18.3
Remediation for Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
Patches
- Apache ActiveMQ 5.15.16, 5.16.7, 5.17.6, 5.18.3 (activemq-client and activemq-openwire-legacy)
Immediate actions
- Upgrade Apache ActiveMQ brokers and clients to 5.15.16, 5.16.7, 5.17.6 or 5.18.3 (or later) and remove OpenWire exposure from the internet
- Block 166.62.100.52 (ports 2460 and 6761) at the perimeter and hunt for connections to it
- Hunt for AnyDesk client ID 1312001388, unexpected AnyDesk services (Event ID 7045), and the kesknq service/named pipe
- Rotate privileged service account credentials that were logged on to the ActiveMQ host or exposed in LSASS
Workarounds
- Restrict network access to the OpenWire port (61616) to trusted hosts only
- Monitor OpenWire traffic for ClassPathXmlApplicationContext in the Throwable field (Emerging Threats SIDs 2049045, 2049046, 2049385)
Longer-term hardening
- Segment internet-facing message brokers from the internal network and restrict outbound traffic from them
- Enable LSASS protection (RunAsPPL/Credential Guard) and avoid privileged service accounts on exposed servers
- Alert on Java processes spawning cmd.exe, PowerShell or certutil
- Alert on Security Event 1102 and System Event 104 log clearing and on Defender tampering via SystemSettingsAdminFlows.exe
- Restrict unapproved remote access tools such as AnyDesk and maintain offline, tested backups
CVEs associated with Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
Weaknesses (CWE) in Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
Timeline of Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
- CISA adds CVE-2023-46604 (Apache ActiveMQ OpenWire RCE) to the Known Exploited Vulnerabilities catalog; remediation due 2023-11-23.
- About 40 minutes after exploitation the actor runs Metasploit getsystem (service/named pipe kesknq) and begins LSASS dumping; SMB scanning follows about an hour in; AnyDesk, rdp.bat, log clearing and Defender tampering are also observed in this round.
- Mid-February 2024 (exact day not stated; date approximate): actor exploits CVE-2023-46604 on an internet-exposed ActiveMQ server and uses certutil to download a Metasploit stager (uFSyLszKsuR.exe) from 166.62.100.52.
- Day two (date approximate): actor runs discovery commands (netstat -t, domain admins group queries) and tries to add an account to a privileged group, then loses access.
- Under 90 minutes after second access, LockBit binaries (LB3.exe, LB3_pass.exe) are deployed across hosts over roughly four hours of activity; ransom notes direct victims to Session messenger.
- About 20 minutes after re-access the actor uses the previously dumped privileged service account to reach domain controllers via Metasploit remote service execution, runs network scanners, and RDPs to backup and file servers.
- About 18 days after first access (date approximate), the actor re-exploits the same ActiveMQ server using the same technique with different file names.
- The DFIR Report publishes 'Apache ActiveMQ Exploit Leads to LockBit Ransomware'.
Sources cited for Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit
- Apache ActiveMQ Exploit Leads to LockBit Ransomware
- NVD - CVE-2023-46604
- Apache ActiveMQ CVE-2023-46604 Security Advisory
- CISA Known Exploited Vulnerabilities Catalog (CVE-2023-46604 added 2023-11-02)
- Apache ActiveMQ Unauthenticated Remote Code Execution (public exploit)
- The DFIR Report Sigma Rules
- Elastic protections-artifacts (Windows_Trojan_Metasploit YARA)
Detection coverage for TL-2026-3952
As of 2026-10-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3952 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.