Apache ActiveMQ RCE Linked to Backdoors and Suspected Ransomware Activity

Attackers have exploited Apache ActiveMQ remote code execution vulnerability CVE-2023-46604 to compromise servers, with AhnLab ASEC reporting suspected links to North Korea’s Andariel group and, separately, actors hosting Mauri ransomware. The flaw allows manipulated OpenWire packets to cause vulnerable servers to load attacker-controlled XML configuration files. In its Andariel investigation, ASEC found NukeSped and TigerRat backdoors on an ActiveMQ server that had also faced exploitation attempts involving HelloKitty ransomware, a Java downloader, Cobalt Strike, and Metasploit Meterpreter. The Andariel attribution and initial-access pathway remained circumstantial because investigators lacked logs directly linking NukeSped installation to the flaw. Separately, Microsoft reported multiple North Korean threat actors exploiting TeamCity vulnerability CVE-2023-42793, highlighting additional targeting of exposed server software.

ASEC’s later investigation of Korean systems identified suspected ActiveMQ exploitation involving backdoor accounts and deployment of Frpc, a reverse-proxy tool. The attackers’ download server hosted Mauri ransomware and Quasar RAT, but investigators did not confirm ransomware execution against victims; some indicators suggested testing. Mauri’s configuration included customized encryption settings, Telegram contact details, and cryptocurrency wallet information. Organizations should patch affected ActiveMQ components, restrict external access, and inventory exposed services. Incident reviews should examine unexpected accounts, proxy tools, and backdoor activity rather than assuming every compromise resulted in ransomware deployment.