Threat Actors Exploit Apache ActiveMQ Vulnerability to Gain RDP Access, Deploy LockBit Ransomware

Apache ActiveMQ Vulnerability Exploitation

Recent incidents have highlighted the exploitation of a critical vulnerability in Apache ActiveMQ, identified as CVE-2023-46604. The vulnerability was used by threat actors to gain access to Windows environments, leading to the deployment of LockBit ransomware through Remote Desktop Protocol (RDP).

The attackers utilized a malicious Java Spring bean configuration XML file, instructing the server to download a payload from a remote host using CertUtil. This payload was a Metasploit stager that communicated with the attackers' command-and-control (C2) infrastructure, effectively transforming the ActiveMQ host into a strategic entry point.

In February 2024, the vulnerability was exploited on an internet-facing Apache ActiveMQ server via the Java OpenWire protocol, enabling remote code execution. Approximately 40 minutes post-exploitation, the attackers conducted post-exploitation activities using Metasploit, likely with Meterpreter.

Privilege Escalation and Lateral Movement

Privilege escalation was achieved using GetSystem to elevate to SYSTEM privileges, followed by accessing the LSASS process memory to extract credentials. Network scanning was indicated by a spike in SMB traffic, with lateral movement achieved using a domain administrator account to execute Metasploit payloads as remote services.

Persistence and defense evasion were established through the deployment of AnyDesk as an AutoStart service and enabling RDP through firewall and registry modifications. The attackers also cleared event logs to obstruct incident response activities.

Eighteen days after the initial attack, the same threat actor re-entered the network, exploiting the ActiveMQ server again using the same vulnerability and C2 infrastructure. Subsequent actions included privilege escalation, credential theft, lateral movement, and the deployment of LockBit ransomware.

The attackers utilized RDP to access critical systems, dropping AnyDesk, network scanning tools, and LockBit payloads. The ransomware was executed interactively over RDP sessions, employing specific path and password flags, and a PsExec-style spreader on critical servers.

Organizations are advised to patch CVE-2023-46604 promptly to prevent unauthorized access. Regular monitoring of network traffic and system logs is recommended to detect and respond to suspicious activities. Employing robust access controls and user authentication mechanisms can also mitigate potential risks.

Based on reporting by GBHackers.