Security News > 2023 > November > Critical Apache ActiveMQ flaw under attack by 'clumsy' ransomware crims
Security researchers have confirmed that ransomware criminals are capitalizing on a maximum-severity vulnerability in Apache ActiveMQ. Announced on October 25 and tracked as CVE-2023-46604, the insecure deserialization vulnerability allows for remote code execution on affected versions.
"Apache ActiveMQ is vulnerable to remote code execution," Apache said in its advisory.
"Based on the ransom note and available evidence, we attribute the activity to the HelloKitty ransomware family, whose source code was leaked on a forum in early October," it said.
There remains a possibility that a lone attacker could have used the source code of the group's 2020 variant that was leaked last month in the attacks.
The experts' assessment of the attempts to deploy ransomware was that they were "Clumsy." Indicating a potentially low-skill individual being behind the attacks, Rapid7 said more than half a dozen attempts to encrypt files were made - all of which were unsuccessful.
Internet security non-profit Shadowserver started tracking vulnerable Apache ActiveMQ services on October 30 and found that almost half of all reachable services were vulnerable to CVE-2023-46604.
- Critical infrastructure software maker confirms ransomware attack (source)
- Victoria court recordings exposed in reported ransomware attack (source)
- Hackers target Apache RocketMQ servers vulnerable to RCE attacks (source)
- Capital Health attack claimed by LockBit ransomware, risk of data leak (source)
- US mortgage lender loanDepot confirms ransomware attack (source)
- Toronto Zoo: Ransomware attack had no impact on animal wellbeing (source)
- Paraguay warns of Black Hunt ransomware attacks after Tigo Business breach (source)
- Hackers target Microsoft SQL servers in Mimic ransomware attacks (source)
- CISA Flags 6 Vulnerabilities - Apple, Apache, Adobe , D-Link, Joomla Under Attack (source)
- Cryptominers Targeting Misconfigured Apache Hadoop and Flink with Rootkit in New Attacks (source)
| Deserialization of Untrusted Data vulnerability in Apache Activemq
The Java OpenWire protocol marshaller is vulnerable to Remote Code Execution.