Circumstances of the Andariel Group Exploiting an Apache ActiveMQ Vulnerability (CVE-2023-46604)

While monitoring recent attacks by the Andariel threat group, AhnLab Security Emergency response Center (ASEC) has discovered the attack case in which the group is assumed to be exploiting Apache ActiveMQ remote code execution vulnerability (CVE-2023-46604) to install malware.

The Andariel threat group usually targets South Korean companies and institutions, and the group is known to be either in a cooperative relationship of the Lazarus threat group, or a subsidiary group of Lazarus. Their attacks against South Korea were first …

activemq ahnlab andariel apache apache activemq apache activemq vulnerability asec attack attacks case center code code execution companies cve cve-2023-46604 emergency exploiting install malware malware analysis monitoring remote code remote code execution response security south threat threat group vulnerability