Tuesday, July 23, 2024

Hackers Actively Exploiting ActiveMQ Vulnerability to Install Malware

Attackers have been exploiting the Apache ActiveMQ Vulnerability (CVE-2023-46604) to steal data and install malware constantly.

Using the Apache ActiveMQ remote code execution vulnerability, the Andariel threat group was found to be installing malware last month. Their primary targets are national defense, political groups, shipbuilding, energy, telecommunications, ICT firms, universities, and logistics firms.

Researchers have now discovered new attacks that installed Ladon, NetCat, AnyDesk, and z0Miner.

Overview of the Apache ActiveMQ Vulnerability

A remote code execution vulnerability in Apache ActiveMQ, an open-source messaging and integration pattern server, is identified as CVE-2023-46604.

“If an unpatched Apache ActiveMQ is externally exposed, the threat actor can execute malicious commands from a remote location and take over the target system,” AhnLab Security Emergency Response Center (ASEC) shared in a report with Cyber Security News.

The vulnerability attack involves manipulating a serialized class type in the OpenWire protocol to instantiate the class in the classpath. When the threat actor sends a modified packet, the susceptible server uses the path (URL) in the packet to load the XML configuration file for the class.

Researchers examine that the latest attacks that have installed malware such as Ladon, NetCat, AnyDesk, and z0Miner.


One of the tools that threat actors who speak Chinese typically employ is Ladon. Ladon provides several features required for the attack procedure. Reverse shell, scanning, privilege escalation, and account credential theft are some of the main characteristics.

Once it was established that a vulnerable version of the Apache ActiveMQ service was being utilized, they downloaded Ladon and executed additional commands using the PowerShell command.

The reverse shell is executed using the ReverseTCP command, and Netcat (nc) was utilized to do this.

Ladon’s GitHub page
Ladon’s GitHub page

AnyDesk & Netcat

Using the TCP/UDP protocol, Netcat is a utility for sending and receiving data to and from specific targets within a network.

It works with both Windows and Linux environments. It may also be said that network managers regularly utilize it because it provides a variety of functions for network testing, but threat actors can also take advantage of it.

Netcat is being installed and executed through a vulnerability attack
Netcat is being installed and executed through a vulnerability attack

The threat actor installed AnyDesk after installing Netcat in the recently discovered attack. AnyDesk was installed, and the setup file was obtained from the original AnyDesk website’s download URL.

Installing AnyDesk using Netcat
Installing AnyDesk using Netcat

“Threat actor would have connected to the infected system and used the password transmitted as the “–set-password” argument upon execution to remotely control the target system,” researchers said.


Attack efforts using XMRig CoinMiner have also been observed recently. The XML configuration file is called “paste.xml,” and it contains information on how to run PowerShell commands using CMD.

The PowerShell script that may be downloaded is simple to use and downloads and executes both the configuration file and XMRig CoinMiner.

PowerShell script that installs XMRig CoinMiner
PowerShell script that installs XMRig CoinMiner

To stop attacks that make use of known vulnerabilities, system administrators need to verify if the Apache ActiveMQ service they are using is one of the vulnerable versions and install the most recent updates.

Finally, caution should be exercised by updating V3 to the most recent version to prevent malware infection in advance.


Latest articles

Beware Of Dating Apps Exposing Your Personal And Location Details To Cyber Criminals

Threat actors often attack dating apps to steal personal data, including sensitive data and...

Hackers Abusing Google Cloud For Phishing

Threat actors often attack cloud services for several illicit purposes. Google Cloud is targeted...

Two Russian Nationals Charged for Cyber Attacks against U.S. Critical Infrastructure

The United States has designated Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko, two members...

Threat Actors Taking Advantage of CrowdStrike BSOD Bug to Deliver Malware

Threat actors have been found exploiting a recently discovered bug in CrowdStrike's software that...

NCA Shut’s Down the Most Popular “digitalstress” DDoS-for-hire Service

The National Crime Agency (NCA) has successfully infiltrated and dismantled one of the most...

Play Ransomware’s Linux Variant Attacking VMware ESXi Servers

A new Linux variant of Play ransomware targets VMware ESXi environments, which encrypts virtual...

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles