Apache ActiveMQ Vulnerability (CVE-2023-46604) Continuously Being Exploited in Attacks

In November 2023, AhnLab Security Emergency response Center (ASEC) published a blog post titled “Circumstances of the Andariel Group Exploiting an Apache ActiveMQ Vulnerability (CVE-2023-46604)” [1] which covered cases of the Andariel threat group exploiting the CVE-2023-46604 vulnerability to install malware. This post not only covered attack cases of the Andariel group but also those of HelloKitty Ransomware, Cobalt Strike, and Metasploit Meterpreter.

Since then, the Apache ActiveMQ vulnerability (CVE-2023-46604) has continued to be exploited by various threat actors. This …

activemq ahnlab andariel apache apache activemq apache activemq vulnerability asec attack attacks blog blog post cases center cve cve-2023-46604 emergency exploited exploiting install malware malware analysis november november 2023 response security threat threat group vulnerability