LockBit builder abused via ActiveMQ flaw

An unpatched Apache ActiveMQ server exploited via CVE-2023-46604 led to Metasploit-based intrusion and deployment of LockBit ransomware built from the leaked builder.

The DFIR Report details an intrusion beginning in mid-February 2024 when a threat actor exploited CVE-2023-46604, a remote code execution vulnerability in Apache ActiveMQ, on an internet-facing server. Using a malicious Java Spring bean configuration XML delivered via OpenWire, the actor executed commands via CertUtil to download a Metasploit stager. Post-exploitation activity included privilege escalation via Meterpreter's getsystem, LSASS credential dumping, SMB-based network scanning, and lateral movement using a compromised domain administrator account. The actor was evicted after roughly a day but returned 18 days later through the same unpatched vulnerability, reusing the same C2 infrastructure (166.62.100.52) and previously harvested credentials.

On regaining access, the actor moved quickly to ransomware deployment: installing AnyDesk for persistence, running Advanced IP Scanner disguised as SoftPerfect, and using RDP with a privileged service account to reach backup, file, and domain controller servers. Ransomware binaries (LB3.exe and LB3_pass.exe) were manually copied and executed across multiple hosts over roughly four hours. Analysis of the ransom note — which directed victims to the Session messaging app instead of standard LockBit Tor/TOX infrastructure — indicates the binaries were built using the leaked LockBit Black builder, suggesting an independent actor operating under the LockBit brand rather than official LockBit affiliate infrastructure.

The case highlights the risk of delayed patching: the initial compromise went undetected for weeks, and had the second intrusion not reused known infrastructure and TTPs, the organization would have had less than 90 minutes between re-engagement and full ransomware execution. Total time-to-ransomware was approximately 419 hours (19 days), reinforcing the value of early detection during the reconnaissance and lateral movement phases.

title: CertUtil Download via Command Line
description: Detects CertUtil.exe executing with -urlcache or -split command-line
  arguments to download files from remote sources. This is a common post-exploitation
  technique following public-facing application compromise.
tags:
- attack.defense-evasion
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \certutil.exe
    CommandLine|contains:
    - -urlcache
    - -split
  filter_admin_use:
    User|contains: SYSTEM
    CommandLine|contains: -generateSSTFromWU
  condition: selection and not filter_admin_use
falsepositives:
- Legitimate system administration tools using CertUtil for certificate validation
- Windows Update certificate chain downloads
level: high
id: 578a38f4-eea5-5bad-ad85-4badbd6a0275
status: experimental
author: Vorant

title: Credential Dumping via LSASS Process Access
description: Detects process access to LSASS.exe from non-system, non-svchost processes.
  LSASS credential dumping is a post-compromise activity commonly observed during
  lateral movement preparation.
tags:
- attack.credential-access
- attack.t1003.001
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|endswith: \lsass.exe
    GrantedAccess:
    - '0x1010'
    - '0x1038'
    - '0x143a'
    - '0x1438'
  filter_legitimate:
    SourceImage|endswith:
    - \svchost.exe
    - \services.exe
    - \lsm.exe
    - \wininit.exe
  condition: selection and not filter_legitimate
falsepositives:
- Endpoint detection and response tools performing memory scans
- Authorized penetration testing tools
level: high
id: cab08756-028a-5e04-ae8b-1732ccda3cec
status: experimental
author: Vorant

title: Ransomware Binary Execution from Lateral Movement Paths
description: Detects execution of LockBit-style ransomware binaries (LB3.exe, LB3_pass.exe)
  often deployed after RDP/SMB lateral movement. Generalises on the distinctive filename
  pattern and execution from non-standard paths.
tags:
- attack.impact
- attack.t1486
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
    - \LB3.exe
    - \LB3_pass.exe
  selection_path:
    CommandLine|contains:
    - \\\\
    - admin$
    - c$
    - d$
  filter_builtin:
    User|contains: Microsoft
  condition: (selection or selection_path) and not filter_builtin
falsepositives:
- Legitimate backup software with similar naming
- Third-party encryption tools deployed via network shares
level: critical
id: 29c82db6-8c36-5b20-83eb-bd7cfe7775ac
status: experimental
author: Vorant

Source reporting: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware