Security News > 2023 > November > Critical Apache ActiveMQ flaw under attack by 'clumsy' ransomware crims
Security researchers have confirmed that ransomware criminals are capitalizing on a maximum-severity vulnerability in Apache ActiveMQ. Announced on October 25 and tracked as CVE-2023-46604, the insecure deserialization vulnerability allows for remote code execution on affected versions.
"Apache ActiveMQ is vulnerable to remote code execution," Apache said in its advisory.
"Based on the ransom note and available evidence, we attribute the activity to the HelloKitty ransomware family, whose source code was leaked on a forum in early October," it said.
There remains a possibility that a lone attacker could have used the source code of the group's 2020 variant that was leaked last month in the attacks.
The experts' assessment of the attempts to deploy ransomware was that they were "Clumsy." Indicating a potentially low-skill individual being behind the attacks, Rapid7 said more than half a dozen attempts to encrypt files were made - all of which were unsuccessful.
Internet security non-profit Shadowserver started tracking vulnerable Apache ActiveMQ services on October 30 and found that almost half of all reachable services were vulnerable to CVE-2023-46604.
News URL
https://go.theregister.com/feed/www.theregister.com/2023/11/02/apache_activemq_vulnerability/
Related news
- Critical Veeam RCE bug now used in Frag ransomware attacks (source)
- Embargo ransomware escalates attacks to cloud environments (source)
- Critical Flaws in Tank Gauge Systems Expose Gas Stations to Remote Attacks (source)
- JPCERT shares Windows Event Log tips to detect ransomware attacks (source)
- Ransomware attack forces UMC Health System to divert some patients (source)
- Researchers Warn of Ongoing Attacks Exploiting Critical Zimbra Postjournal Flaw (source)
- Critical Ivanti RCE flaw with public exploit now used in attacks (source)
- Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications (source)
- CISA says critical Fortinet RCE flaw now exploited in attacks (source)
- Underground ransomware claims attack on Casio, leaks stolen data (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-10-27 | CVE-2023-46604 | Deserialization of Untrusted Data vulnerability in multiple products The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. | 9.8 |