LockBit builder abused via ActiveMQ flaw
An unpatched Apache ActiveMQ server exploited via CVE-2023-46604 led to Metasploit-based intrusion and deployment of LockBit ransomware built from the leaked builder.
Sourcethedfirreport.com — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2023-46604 as exploited in the wild.
The DFIR Report details an intrusion beginning in mid-February 2024 when a threat actor exploited CVE-2023-46604, a remote code execution vulnerability in Apache ActiveMQ, on an internet-facing server. Using a malicious Java Spring bean configuration XML delivered via OpenWire, the actor executed commands via CertUtil to download a Metasploit stager. Post-exploitation activity included privilege escalation via Meterpreter's getsystem, LSASS credential dumping, SMB-based network scanning, and lateral movement using a compromised domain administrator account. The actor was evicted after roughly a day but returned 18 days later through the same unpatched vulnerability, reusing the same C2 infrastructure (166.62.100.52) and previously harvested credentials.
On regaining access, the actor moved quickly to ransomware deployment: installing AnyDesk for persistence, running Advanced IP Scanner disguised as SoftPerfect, and using RDP with a privileged service account to reach backup, file, and domain controller servers. Ransomware binaries (LB3.exe and LB3_pass.exe) were manually copied and executed across multiple hosts over roughly four hours. Analysis of the ransom note — which directed victims to the Session messaging app instead of standard LockBit Tor/TOX infrastructure — indicates the binaries were built using the leaked LockBit Black builder, suggesting an independent actor operating under the LockBit brand rather than official LockBit affiliate infrastructure.
The case highlights the risk of delayed patching: the initial compromise went undetected for weeks, and had the second intrusion not reused known infrastructure and TTPs, the organization would have had less than 90 minutes between re-engagement and full ransomware execution. Total time-to-ransomware was approximately 419 hours (19 days), reinforcing the value of early detection during the reconnaissance and lateral movement phases.
Mentioned in this report
Detection guidance
CertUtil Download via Command Line
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
CertUtil.exe invoked with -urlcache or -split flags to download remote files, commonly abused for code delivery post-RCE. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CertUtil Download via Command Line
description: Detects CertUtil.exe executing with -urlcache or -split command-line
arguments to download files from remote sources. This is a common post-exploitation
technique following public-facing application compromise.
tags:
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \certutil.exe
CommandLine|contains:
- -urlcache
- -split
filter_admin_use:
User|contains: SYSTEM
CommandLine|contains: -generateSSTFromWU
condition: selection and not filter_admin_use
falsepositives:
- Legitimate system administration tools using CertUtil for certificate validation
- Windows Update certificate chain downloads
level: high
id: 578a38f4-eea5-5bad-ad85-4badbd6a0275
status: experimental
author: Vorant
Credential Dumping via LSASS Process Access
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Process access attempts to LSASS.exe by non-system tools, indicating credential extraction activity. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Credential Dumping via LSASS Process Access
description: Detects process access to LSASS.exe from non-system, non-svchost processes.
LSASS credential dumping is a post-compromise activity commonly observed during
lateral movement preparation.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|endswith: \lsass.exe
GrantedAccess:
- '0x1010'
- '0x1038'
- '0x143a'
- '0x1438'
filter_legitimate:
SourceImage|endswith:
- \svchost.exe
- \services.exe
- \lsm.exe
- \wininit.exe
condition: selection and not filter_legitimate
falsepositives:
- Endpoint detection and response tools performing memory scans
- Authorized penetration testing tools
level: high
id: cab08756-028a-5e04-ae8b-1732ccda3cec
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs, actors, and malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs