# LockBit hits via ActiveMQ CVE-2023-46604

Published: 2026-02-23 · Severity: high
Canonical: https://vorant.io/reports/ecb029d1-35b8-569e-9b21-7149a87fe56e/lockbit-hits-via-activemq-cve-2023-46604

> Threat actor exploited CVE-2023-46604 in Apache ActiveMQ twice over 18 days, deploying Metasploit for credential theft and lateral movement before deploying LockBit ransomware built with the leaked builder.

A threat actor exploited an unpatched Apache ActiveMQ server running CVE-2023-46604 in mid-February 2024, achieving remote code execution through a malicious Java Spring bean configuration. The actor deployed a Metasploit stager, escalated to SYSTEM privileges, dumped LSASS memory to harvest credentials including a privileged service account, and moved laterally via remote service execution. Despite being evicted after initial discovery activity on day two, the unpatched server allowed re-entry 18 days later using the identical exploit chain.

Upon return, the actor moved directly to impact objectives, using previously stolen credentials for RDP-based lateral movement and installing AnyDesk for persistent access. Within 90 minutes of re-entry, the actor deployed LockBit ransomware across file servers, backup systems, and domain controllers. The ransomware was assessed to have been built using the leaked LockBit Black builder rather than official affiliate tooling, evidenced by a modified ransom note directing victims to the Session messaging app instead of standard LockBit Tor infrastructure. Time to ransomware was 419 hours from initial access, though organizations detecting only the second round faced under 90 minutes before encryption began.

The intrusion demonstrates the criticality of patching internet-facing services and the persistence risk when initial compromises go undetected. The actor's credential harvesting during round one directly enabled the rapid ransomware deployment in round two, with no need to re-establish footholds or repeat discovery phases.

## Mentioned in this report

- Vulnerabilities: CVE-2023-46604 (KEV)
- Malware: LockBit, Metasploit, Meterpreter

## Detection guidance (public sample)

### Java Process Spawning Command Shell (Possible ActiveMQ CVE-2023-46604 Exploitation)

ATT&CK: T1190

Detects java.exe (e.g., Apache ActiveMQ) spawning a command interpreter or scripting engine, consistent with RCE via malicious Spring bean deserialization exploited in CVE-2023-46604. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Java Process Spawning Command Interpreter
id: 2a176538-09e5-55a6-9b7e-b5ac0764aa2d
status: experimental
description: Detects java.exe (commonly ActiveMQ) spawning cmd.exe, powershell.exe,
  or other proxy execution binaries, consistent with exploitation of CVE-2023-46604
  leading to remote code execution.
references:
- CVE-2023-46604
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \\java.exe
    Image|endswith:
    - \\cmd.exe
    - \\powershell.exe
    - \\powershell_ise.exe
    - \\mshta.exe
    - \\rundll32.exe
    - \\wscript.exe
    - \\cscript.exe
  filter_common:
    CommandLine|contains:
    - jenkins
    - tomcat-manager
  condition: selection and not filter_common
falsepositives:
- Legitimate Java-based application servers that intentionally call out to shell scripts
  or batch files as part of normal operation
- Custom monitoring or deployment scripts invoked from Java middleware
level: high
tags:
- attack.t1190
- attack.t1059.003
- attack.t1059.001
- attack.t1218
author: Vorant
```

### LSASS Memory Dump via Rundll32 comsvcs.dll MiniDump

ATT&CK: T1003.001

Detects use of rundll32.exe with comsvcs.dll MiniDump export to dump LSASS process memory for credential harvesting, as used in the ActiveMQ/LockBit intrusion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: LSASS Dump via comsvcs.dll MiniDump
id: b63c8ef9-a6b8-55db-850a-dc94c38434fa
status: experimental
description: Detects rundll32.exe invoking comsvcs.dll's MiniDump export, a common
  living-off-the-land technique to dump LSASS memory for credential theft.
references:
- https://attack.mitre.org/techniques/T1003/001/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\rundll32.exe
    CommandLine|contains|all:
    - comsvcs.dll
    - MiniDump
  condition: selection
falsepositives:
- Authorized incident-response or forensic memory capture using the same technique
level: high
tags:
- attack.t1003.001
- attack.t1218
author: Vorant
```

### AnyDesk Silent Install or Unattended Configuration

ATT&CK: T1219

Detects silent installation or unattended startup configuration of AnyDesk remote access tool, matching the persistence method used after ransomware re-entry in this intrusion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: AnyDesk Silent Install for Remote Access Persistence
id: 7e1af546-3d6f-5ee0-b1b9-a61ec6d314fb
status: experimental
description: Detects command-line indicators of AnyDesk being installed or configured
  silently/unattended, a pattern seen when threat actors deploy AnyDesk for persistent
  remote access following credential-enabled lateral movement.
references:
- https://attack.mitre.org/techniques/T1219/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \\anydesk.exe
    CommandLine|contains:
    - --install
    - --silent
    - --start-with-win
    - --set-password
  filter_admin:
    ParentImage|endswith:
    - \\sccm*.exe
    - \\ninite.exe
  condition: selection and not filter_admin
falsepositives:
- Legitimate IT deployment of AnyDesk for remote support via software distribution
  tools
- Help desk staff pre-configuring AnyDesk on new endpoints
level: medium
tags:
- attack.t1219
- attack.t1021.001
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ecb029d1-35b8-569e-9b21-7149a87fe56e/lockbit-hits-via-activemq-cve-2023-46604.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup