Loading story…
Attackers are exploiting Apache ActiveMQ flaw CVE-2023-46604, an unauthenticated remote code execution bug in the OpenWire protocol caused by unsafe deserialization, to gain initial access to exposed brokers. Security reporting tied the vulnerability to real-world intrusions soon after disclosure, and later incidents showed it being used to compromise both Windows- and Linux-based environments. In one campaign, the access was leveraged to deploy LockBit ransomware after attackers obtained RDP access, underscoring how a broker compromise can quickly lead to broader domain or server takeover.
Separate investigations found Linux-focused post-exploitation activity in which intruders used the same ActiveMQ weakness to install a Sliver implant and a newly identified malware family, DripDropper, which relied on an attacker-controlled Dropbox account for command-and-control and persistence actions. Researchers reported attackers modifying SSH settings to enable root access, adding persistence through cron and SSH configuration changes, and even patching the vulnerable ActiveMQ service after entry to block rival attackers and reduce the chance of discovery. Although Apache released fixes in October 2023, vulnerable and delayed-to-patch deployments have remained exposed long enough to support continued exploitation.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Cyberpress reported that exploitation of CVE-2023-46604 had been used to deploy LockBit ransomware, with attackers leveraging RDP access during the intrusion chain. This added ransomware deployment as a documented outcome of ActiveMQ compromise.
Red Canary observed attackers exploiting CVE-2023-46604 on dozens of Linux systems, deploying a newly identified malware family called DripDropper along with a Sliver implant. The intrusions also involved SSH configuration changes, cron-based persistence, and attackers patching the vulnerability after gaining access to reduce detection.
Oracle did not ship a fix for affected products until January, extending exposure for some downstream users after Apache had already patched the issue. This delayed remediation contributed to the vulnerability remaining exploitable in the wild.
Rapid7 published research indicating suspected exploitation of CVE-2023-46604 shortly after disclosure, showing attackers were already targeting vulnerable Apache ActiveMQ servers. This marked the vulnerability's transition from disclosure to active threat activity.
Apache ActiveMQ disclosed CVE-2023-46604, an unbounded deserialization flaw in the OpenWire protocol that allows remote code execution, and released fixes for affected versions. The vulnerability was publicly documented on the oss-security mailing list.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
4 references tracked. Mallory keeps watching after this page renders.
cyberpress.org
Open sourcetheregister.com
Open sourcerapid7.com
Open sourceopenwall.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have actively exploited **CVE-2023-46604**, a remote code execution flaw in **Apache ActiveMQ**, to compromise Linux systems and install **Kinsing** (also known as **h2miner**). The vulnerability stems from improper validation of throwable class types in **OpenWire** commands during unmarshalling, allowing malicious code execution on exposed brokers. Trend Micro reported that intrusions led to the delivery of cryptocurrency-mining payloads and rootkit components, causing performance degradation and broader infrastructure impact. Affected software includes multiple **Apache ActiveMQ** and **Legacy OpenWire Module** versions prior to the vendor’s patched releases. Apache addressed the issue by adding a `validateIsThrowable` check in the `BaseDataStreamMarshall` class, and organizations were urged to upgrade to **5.15.16**, **5.16.7**, **5.17.6**, or **5.18.3** to block further exploitation and malware deployment.
Aug 15, 2026
Threat actors continue to prioritize internet-facing infrastructure that provides high-leverage initial access, with multiple reports highlighting **active exploitation of remote code execution (RCE) paths** in widely deployed services. A DFIR case study described attackers exploiting **Apache ActiveMQ** `CVE-2023-46604` by sending a crafted OpenWire command that forced the broker to load a remote Spring XML configuration, leading to payload retrieval via `certutil`, rapid privilege escalation to **SYSTEM**, credential dumping from **LSASS**, and eventual **LockBit** ransomware deployment via **RDP** after re-entry using previously stolen privileged credentials. Separately, incident-response reporting warned of ongoing exploitation against **Managed File Transfer (MFT)** products, including Gladinet *CentreStack* (an LFI issue `CVE-2025-11371` used in an exploit chain culminating in RCE, patched as `CVE-2025-30406`) and Fortra *GoAnywhere MFT* (`CVE-2025-10035`, improper deserialization leading to RCE), with observed activity linked to a threat group associated with **Medusa** ransomware. Broader telemetry and research reinforced that edge and externally exposed services remain the primary battleground for initial access at scale. GreyNoise reported nearly **3 billion** malicious sessions against edge infrastructure in 2H 2025, with heavy targeting of enterprise VPNs (notably **Palo Alto GlobalProtect**) and continued exploitation attempts for older issues such as `CVE-2020-2034`, alongside pervasive scanning of **SSH** and remote access services. In parallel, financially motivated and cybercrime-enabling ecosystems are improving their ability to reach victims: Varonis detailed **1Campaign**, a cloaking service that helps malicious **Google Ads** evade review by serving benign pages to scanners while directing real users to phishing/crypto-drainer content, and Have I Been Squatted documented **Diesel Vortex**, a logistics-focused credential-phishing operation using dozens of domains and an exposed backend repository to support industrialized theft. These trends align with reporting that attackers are increasingly using **AI-assisted social engineering and tooling** (including deepfakes and AI-generated phishing) and with law-enforcement actions such as Interpol-backed **Operation Red Card 2.0**, which resulted in **651 arrests** and $4.3M recovered from cyber-enabled fraud activity across 16 African countries.
Jun 29, 2026
Attackers have been exploiting remote code execution flaws in the Sunlogin and AweSun remote-control tools to compromise exposed systems and install multiple malware families, including **PlugX** and **Sliver**. AhnLab reported that vulnerable Sunlogin versions—especially releases earlier than `11.0.0.33`—were used in campaigns tied to `CNVD-2022-10270` and `CNVD-2022-03672`, with additional payloads such as **Gh0st RAT**, **XMRig**, and **Powercat** also observed. In one intrusion, the attackers used a PowerShell-based chain and a bring-your-own-vulnerable-driver (**BYOVD**) technique leveraging `mhyprot2.sys` to disable security tools before launching a reverse shell and later deploying a Sliver implant configured for **mTLS** command-and-control. In a separate but related campaign, attackers used Sunlogin and AweSun exploitation to deliver the **PlugX** backdoor through a DLL side-loading chain. A legitimate ESET executable, `esetservice.exe`, loaded a malicious `http_dll.dll`, which decrypted and executed PlugX from `lang.dat` directly in memory. AhnLab linked the activity to infrastructure at `imango[.]ink`, including `api.imango[.]ink` and `cdn.imango[.]ink` over ports `443` and `53`. The PlugX sample matched the **BackDoor.PlugX.38** family and supported UAC bypass, service installation, process injection, plugin execution, keylogging, clipboard theft, screenshot capture, remote shell access, and RDP-based propagation, underscoring continued abuse of remote-management software vulnerabilities for persistent backdoor deployment.
Aug 15, 2026