Hackers Exploiting Apache ActiveMQ Vulnerability to Gain Access to Cloud Linux Systems
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
A sophisticated campaign uncovered where adversaries are exploiting CVE-2023-46604, a critical remote code execution vulnerability in Apache ActiveMQ, to compromise cloud-based Linux systems.<\/p>\n
In this case, attackers are patching the very vulnerability they exploited to maintain exclusive access and evade detection, demonstrating advanced operational security practices<\/a> typically reserved for nation-state actors.<\/p>\n The campaign targets Apache ActiveMQ, a widely used open source message broker written in Java, leveraging CVE-2023-46604 to execute arbitrary code on vulnerable systems.\u00a0<\/p>\n Red Canary detected<\/a> adversaries conducting discovery commands across dozens of cloud-based<\/a> Linux endpoints, with the vulnerability carrying a 94.44 percent likelihood of exploitation according to its EPSS score.\u00a0<\/p>\n Security researchers have previously documented this vulnerability being exploited to deploy various malware families, including TellYouThePass, Ransomhub, HelloKitty ransomware, and Kinsing cryptocurrency miners.<\/p>\n After gaining initial access, the attackers deploy sophisticated command and control infrastructure using legitimate tools like Sliver implants and Cloudflare Tunnels to maintain persistent access.\u00a0<\/p>\n The adversaries modify SSH daemon configurations by enabling root login access, which is typically disabled by default in modern Linux<\/a> distributions, granting them the highest level of system privileges.<\/p>\n The threat actors deploy a previously unknown malware strain dubbed \u201cDripDropper,\u201d described as an encrypted PyInstaller ELF (Executable and Linkable Format) file that requires a password to execute, hindering automated sandbox analysis.\u00a0<\/p>\n DripDropper communicates with adversary-controlled Dropbox accounts using hardcoded bearer tokens, leveraging legitimate cloud services to blend malicious traffic with normal network activity.<\/p>\n The malware establishes persistence by modifying the 0anacron file in \/etc\/cron.*\/ directories and creates two additional malicious files with randomized eight-character alphabetical names.\u00a0<\/p>\nKey Takeaways<\/mark><\/strong>
1. Attackers exploit an Apache ActiveMQ vulnerability for remote access to cloud Linux systems.
2. Hackers patch the vulnerability after compromise to prevent detection.
3. New malware uses Dropbox for C2 and modifies SSH for persistent backdoor access.<\/pre>\nNew \u2018DripDropper\u2019 Malware Deployed<\/strong><\/h2>\n