# Apache ActiveMQ Exploit (CVE-2023-46604) Leads to LockBit Ransomware

> The DFIR Report documents an intrusion in which an unattributed actor exploited CVE-2023-46604 in an internet-exposed Apache ActiveMQ server, deployed a Metasploit stager/Meterpreter and AnyDesk, dumped LSASS credentials, moved laterally, and deployed LockBit ransomware built with the leaked LockBit builder. Initial compromise occurred in mid-February 2024, the actor re-exploited the same server 18 days later, and ransomware executed in under 90 minutes from the second access.

- **Published:** 2026-10-20T11:12:39Z
- **Last reviewed:** 2026-10-20T11:12:39Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3952
- **ID:** TL-2026-3952
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-46604

## Description

Initial access was via CVE-2023-46604, a deserialization flaw (CWE-502) in the Apache ActiveMQ OpenWire protocol marshaller. The actor sent a crafted OpenWire command whose Throwable class-type field caused the broker to instantiate org.springframework.context.support.ClassPathXmlApplicationContext with a URL to an attacker-hosted Spring XML bean configuration. The XML ran OS commands with the ActiveMQ Java process as parent; CertUtil (certutil -urlcache -split -f) downloaded a Metasploit stager (uFSyLszKsuR.exe) to the user's Temp directory. The same technique was used in both intrusion rounds, with only file names changed.

Round one (mid-February 2024): roughly 40 minutes after exploitation the actor ran Metasploit getsystem, which created a service named kesknq executing cmd.exe /c echo kesknq > \\.\pipe\kesknq (named-pipe impersonation). LSASS memory was accessed from injected code (Sysmon GrantedAccess 0x1010, CallTrace UNKNOWN) on four hosts, including one holding a privileged service account. About an hour in, SMB traffic spiked toward other systems, consistent with scanning. AnyDesk was installed with an auto-start service (System Event ID 7045) and logged in from 166.62.100.52 (client ID 1312001388). Event logs were cleared (Event IDs 104 and 1102), a batch file rdp.bat configured RDP firewall rules and port 3389, and SystemSettingsAdminFlows.exe was used to disable Microsoft Defender settings on an Exchange server. On day two the actor ran discovery commands with syntax errors (e.g. netstat -t) and tried to add an already-privileged account to the domain admins group, then lost access.

Round two (18 days later): the actor re-exploited the same ActiveMQ server and reused the privileged service account credentials dumped in round one. Within about 20 minutes they moved laterally using Metasploit remote service execution (obfuscated PowerShell: string concatenation, {0}/{1} placeholders, Base64, Gzip) to domain controllers, dropped a renamed Advanced IP Scanner and netscan.exe, queried net group "domain admins", and RDP'd into backup and file servers (1-10 minutes per host). LockBit binaries LB3_pass.exe and LB3.exe (the latter with a -psex SMB spreader option) were staged in C:\Intel and user Downloads folders, copied over RDP and launched via an injected Winlogon process or Explorer. Ransom notes and desktop wallpaper were changed; the note directs victims to the Session messenger rather than the standard LockBit Tor/TOX infrastructure, which the report treats as evidence of an independent actor using the leaked builder. Defender blocked some Metasploit lateral-movement attempts. No data exfiltration was reported. Time to ransomware was about 419 hours from first access but under 90 minutes from the second access.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1569.002 Service Execution
- T1543.003 Windows Service
- T1078.002 Domain Accounts
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1003.001 LSASS Memory
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1087.002 Domain Account
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1571 Non-Standard Port
- T1491.001 Internal Defacement

## Sources

- [Apache ActiveMQ Exploit Leads to LockBit Ransomware](https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/)
- [NVD - CVE-2023-46604](https://nvd.nist.gov/vuln/detail/CVE-2023-46604)
- [Apache ActiveMQ CVE-2023-46604 Security Advisory](https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt)
- [CISA Known Exploited Vulnerabilities Catalog (CVE-2023-46604 added 2023-11-02)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Apache ActiveMQ Unauthenticated Remote Code Execution (public exploit)](https://packetstormsecurity.com/files/175676/Apache-ActiveMQ-Unauthenticated-Remote-Code-Execution.html)
- [The DFIR Report Sigma Rules](https://github.com/The-DFIR-Report/Sigma-Rules)
- [Elastic protections-artifacts (Windows_Trojan_Metasploit YARA)](https://github.com/elastic/protections-artifacts)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3952