{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "ActiveMQ RCE allows for rapid, high-privilege ingress; confirming the absence of these staging patterns provides a critical negative result for a known ransomware entry point." }, "name": "ActiveMQ Exploitation and Metasploit Staging", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1105", "attack.t1059.003", "attack.t1134", "attack.t1055", "attack.t1003.001" ], "series": { "slug": "apache-activemq-exploit-leads-to-lockbit-ransomware", "index": 1, "title": "Apache ActiveMQ Exploit Leads to LockBit Ransomware", "total": 3 }, "related": [ { "hunt": "activemq-internal-reconnaissance", "reason": "This hunt targets the beachhead; a following hunt tracks the actor's SMB scanning and lateral movement.", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "While a rule can catch the exploit attempt, this hunt correlates the RCE with specific functional outcomes like named-pipe impersonation and rare injected processes across multiple surfaces (inventory, process, and network) to identify successful compromise.", "coverage": [ { "stage": "activemq-rce-exploitation", "steps": [ "identify-activemq-hosts", "activemq-child-processes" ], "status": "covered" }, { "stage": "metasploit-payload-ingress", "steps": [ "network-to-c2-ingress", "activemq-child-processes" ], "status": "covered" }, { "stage": "local-privilege-escalation", "steps": [ "meterpreter-escalation-signals" ], "status": "covered" }, { "stage": "credential-dumping-lsass", "steps": [ "meterpreter-escalation-signals" ], "status": "covered" }, { "stage": "internal-discovery-and-persistence", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-and-log-clearing", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rdp", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "lockbit-ransomware-deployment", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Apache ActiveMQ RCE Exploitation", "slug": "activemq-rce-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2023-46604", "org.springframework.context.support.ClassPathXmlApplicationContext", "ActiveMQ server process java.exe parent", "Java Spring bean configuration XML file download" ] }, { "name": "Metasploit Payload Ingress", "slug": "metasploit-payload-ingress", "tactic": "execution", "techniques": [ "T1105", "T1059.003" ], "observables": [ "certutil.exe -urlcache -f", "uFSyLszKsuR.exe", "C:\\Users\\\\AppData\\Local\\Temp\\uFSyLszKsuR.exe", "166.62.100.52" ] }, { "name": "Privilege Escalation via getsystem", "slug": "local-privilege-escalation", "tactic": "privilege-escalation", "techniques": [ "T1134", "T1055" ], "observables": [ "cmd.exe /c echo kesknq > \\\\.\\pipe\\kesknq", "Metasploit stager with SYSTEM level permissions", "Service name kesknq" ] }, { "name": "Credential Access via LSASS Dumping", "slug": "credential-dumping-lsass", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "lsass.exe memory access", "GrantedAccess 0x1010 (VMRead)", "CallTrace UNKNOWN indicative of injected code" ] }, { "name": "Internal Discovery and Persistence", "slug": "internal-discovery-and-persistence", "tactic": "discovery", "techniques": [ "T1046", "T1018", "T1133" ], "observables": [ "AnyDesk.exe installation", "AnyDesk Service creation (Event ID 7045)", "Advanced_IP_Scanner.exe", "SMB traffic spikes (network scanning)" ] }, { "name": "Defense Evasion and Log Clearing", "slug": "defense-evasion-and-log-clearing", "tactic": "defense-evasion", "techniques": [ "T1070.001", "T1562.001", "T1218" ], "observables": [ "rdp.bat creation and deletion", "wevtutil cl System", "wevtutil cl Security", "SystemSettingsAdminFlows.exe used to disable Windows Defender", "Injected winlogon.exe creating batch files" ] }, { "name": "Lateral Movement via RDP and Services", "slug": "lateral-movement-rdp", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1021.002", "T1543.003" ], "observables": [ "RDP connections using privileged service accounts", "Remote service execution of Metasploit payloads", "Firewall modification to allow port 3389" ] }, { "name": "LockBit Ransomware Deployment", "slug": "lockbit-ransomware-deployment", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "LockBit ransomware binary execution", "Execution with specific path and password flags", "Execution from Downloads folder via double-click" ] } ], "summary": "A threat actor exploited an internet-facing Apache ActiveMQ server using CVE-2023-46604 to execute code via Java Spring bean XML files, subsequently downloading a Metasploit stager using CertUtil. The intrusion involved privilege escalation via getsystem, credential dumping from LSASS, and extensive lateral movement using RDP and remote services before deploying LockBit ransomware." }, "severity": "high", "rationale": "Focus on servers hosting ActiveMQ and widen the search to any Java-based web application if the initial scope is empty.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder has exploited CVE-2023-46604 on an ActiveMQ server to run arbitrary code, staged a Metasploit payload, and escalated to SYSTEM privileges using named pipe impersonation.", "parameters": { "c2_ips": { "from": { "ref": "https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/", "kind": "article", "observed": "2024-02-23" }, "type": "list[ip]", "default": [ "166.62.100.52" ], "description": "C2 server IPs observed in the report." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hostnames to focus on." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "suspicious_utilities": { "from": { "ref": "https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/", "kind": "article", "observed": "2024-02-23" }, "type": "list[string]", "default": [ "cmd.exe", "powershell.exe", "certutil.exe" ], "description": "Binaries commonly spawned by the broker during RCE." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/", "name": "The DFIR Report \u2014 Apache ActiveMQ Exploit Leads to LockBit Ransomware" } ], "blind_spots": [ { "id": "missing-process-telemetry", "risk": "Exploitation could occur on unmonitored servers, leaving the intrusion invisible until lateral movement begins.", "stage": "activemq-rce-exploitation", "question": "whether the Java process spawned a shell on hosts without telemetry", "requires": "an endpoint agent on every server in scope" }, { "id": "lsass-handle-missing", "risk": "Standard process activity does not show the 0x1010 VMRead access described in the article; without handle logs, we rely on the presence of the injected stager alone.", "stage": "credential-dumping-lsass", "question": "the specific access mask and call trace of LSASS access", "requires": "Sysmon Event ID 10 or equivalent handle-auditing" } ] }, "name": "ActiveMQ Exploitation and Metasploit Staging", "description": "This hunt targets the initial breach and local consolidation phases of a ransomware intrusion. It begins by identifying the ActiveMQ footprint, then searches for anomalous process forks from the Java broker and outbound C2 connections. A follow-on phase hunts for Meterpreter-specific privilege escalation patterns, such as named-pipe impersonation and injected system processes. Two agent stages weigh the early and late evidence to confirm a beachhead and escalation before routing to containment." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "apache-activemq-exploit-leads-to-lockbit-ransomware", "index": 1, "title": "Apache ActiveMQ Exploit Leads to LockBit Ransomware", "total": 3 }, "coverage": [ { "stage": "activemq-rce-exploitation", "steps": [ "identify-activemq-hosts", "activemq-child-processes" ], "status": "covered" }, { "stage": "metasploit-payload-ingress", "steps": [ "network-to-c2-ingress", "activemq-child-processes" ], "status": "covered" }, { "stage": "local-privilege-escalation", "steps": [ "meterpreter-escalation-signals" ], "status": "covered" }, { "stage": "credential-dumping-lsass", "steps": [ "meterpreter-escalation-signals" ], "status": "covered" }, { "stage": "internal-discovery-and-persistence", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-and-log-clearing", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "lateral-movement-rdp", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "lockbit-ransomware-deployment", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" } ], "rationale": "An intruder has exploited CVE-2023-46604 on an ActiveMQ server to run arbitrary code, staged a Metasploit payload, and escalated to SYSTEM privileges using named pipe impersonation.", "blind_spots": [ { "id": "missing-process-telemetry", "risk": "Exploitation could occur on unmonitored servers, leaving the intrusion invisible until lateral movement begins.", "stage": "activemq-rce-exploitation", "question": "whether the Java process spawned a shell on hosts without telemetry", "requires": "an endpoint agent on every server in scope" }, { "id": "lsass-handle-missing", "risk": "Standard process activity does not show the 0x1010 VMRead access described in the article; without handle logs, we rely on the presence of the injected stager alone.", "stage": "credential-dumping-lsass", "question": "the specific access mask and call trace of LSASS access", "requires": "Sysmon Event ID 10 or equivalent handle-auditing" } ], "scoping_notes": "Focus on servers hosting ActiveMQ and widen the search to any Java-based web application if the initial scope is empty.", "beyond_detection": "While a rule can catch the exploit attempt, this hunt correlates the RCE with specific functional outcomes like named-pipe impersonation and rare injected processes across multiple surfaces (inventory, process, and network) to identify successful compromise." } }, { "id": "identify-activemq-hosts", "type": "query", "label": "Identify ActiveMQ infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%activemq%' OR LOWER(install_path) LIKE '%activemq%')", "surface": "hb_software_inventory", "description": "Locate every host running Apache ActiveMQ to narrow the search for RCE signals.", "expected_signal": "A list of hosts hosting the targeted application. Silence suggests no ActiveMQ is present in the inventory." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify ActiveMQ infrastructure", "reads": [ "device_hostname", "package_name", "package_version", "install_path" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE (LOWER(package_name) LIKE '%activemq%' OR LOWER(install_path) LIKE '%activemq%')", "silence": "not_evidence_of_absence", "expected": "A list of hosts hosting the targeted application. Silence suggests no ActiveMQ is present in the inventory.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "activemq-child-processes", "type": "query", "label": "Anomalous ActiveMQ child processes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%java.exe' AND instr(',' || '{{suspicious_utilities}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Find the Java broker spawning shells or downloaders, which confirms RCE execution.", "expected_signal": "The ActiveMQ service spawning a utility like certutil.exe or a shell; this is high-fidelity evidence of exploitation." }, "parents": [ { "id": "identify-activemq-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Anomalous ActiveMQ child processes", "reads": [ "device_hostname", "process_name", "process_cmd_line", "parent_process_name", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, time FROM hb_process_activity WHERE LOWER(parent_process_name) LIKE '%java.exe' AND instr(',' || '{{suspicious_utilities}}' || ',', ',' || LOWER(process_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "evidence_of_absence", "expected": "The ActiveMQ service spawning a utility like certutil.exe or a shell; this is high-fidelity evidence of exploitation.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "network-to-c2-ingress", "type": "query", "label": "Connections to Metasploit C2", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Correlate host activity with the reported IP of the Metasploit stager.", "expected_signal": "Outbound traffic from the beachhead to the specified C2 IP." }, "parents": [ { "id": "identify-activemq-hosts" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Connections to Metasploit C2", "reads": [ "device_hostname", "process_name", "dst_endpoint_ip", "dst_endpoint_port", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, process_name, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{c2_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Outbound traffic from the beachhead to the specified C2 IP.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "triage-early-stage", "type": "analytic", "label": "Triage initial staging", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "activemq-child-processes", "network-to-c2-ingress" ], "objective": "Identify hosts where ActiveMQ executed a suspicious child and contacted the Metasploit C2 IP.", "description": "Determine if the ActiveMQ broker successfully established a beachhead by weighting the process and network signals.", "max_iterations": 4, "expected_signal": "A per-host verdict identifying successful RCE and C2 check-ins.", "success_criteria": "A verdict for each host in the early phase context." }, "parents": [ { "id": "activemq-child-processes", "kind": "merge" }, { "id": "network-to-c2-ingress", "kind": "merge" } ] }, { "id": "meterpreter-escalation-signals", "type": "query", "label": "Named-pipe impersonation and rare system processes", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT LOWER(process_path) AS path, process_cmd_line, device_hostname, integrity_level, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%echo % > \\\\.\\\\pipe\\\\%' OR on_disk = 0 OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND integrity_level = 'System' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING hosts <= 3 ORDER BY hosts ASC", "surface": "hb_process_activity", "description": "Hunt for the follow-on escalation phase using Meterpreter-specific patterns and by baselining rare high-privilege processes.", "expected_signal": "Identification of the getsystem pipe echo pattern or an injected process running as SYSTEM on a single host." }, "parents": [ { "id": "triage-early-stage" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Named-pipe impersonation and rare system processes", "reads": [ "process_path", "process_cmd_line", "device_hostname", "integrity_level", "on_disk", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT LOWER(process_path) AS path, process_cmd_line, device_hostname, integrity_level, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%echo % > \\\\.\\\\pipe\\\\%' OR on_disk = 0 OR LOWER(process_path) LIKE '%\\\\temp\\\\%') AND integrity_level = 'System' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY 1, 2, 3, 4 HAVING hosts <= 3 ORDER BY hosts ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "Identification of the getsystem pipe echo pattern or an injected process running as SYSTEM on a single host.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "triage-full-intrusion", "type": "analytic", "label": "Synthesize the intrusion chain", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "triage-early-stage", "meterpreter-escalation-signals" ], "objective": "Confirm if a host transitioned from ActiveMQ RCE to high-integrity Metasploit execution.", "description": "Combine the early beachhead evidence with the later escalation evidence to provide a high-confidence intrusion verdict.", "max_iterations": 6, "expected_signal": "A confirmed intrusion verdict citing the transition from Java RCE to a SYSTEM-level stager.", "success_criteria": "A final verdict citing the specific commands and network connections across all phases." }, "parents": [ { "id": "meterpreter-escalation-signals" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-full-intrusion verdict is malicious for at least one host showing the transition to SYSTEM privileges", "condition": "the triage-full-intrusion verdict is malicious for at least one host showing the transition to SYSTEM privileges", "blind_spot": "missing-process-telemetry", "confidence": "high", "description": "Route the investigation based on the presence of a confirmed high-integrity intrusion.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-full-intrusion" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate compromised host", "config": { "target": "endpoint", "description": "Prevent lateral movement or the deployment of ransomware by severing the beachhead.", "instructions": "Isolate the host immediately. Capture the process image of any injected or rare SYSTEM processes identified in the triage.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Verify the agent's findings and document the intrusion for follow-on investigations.", "instructions": "Review the process command lines identified in the triage steps. Check for evidence of log clearing (System Log Event ID 104) and LSASS access (Sysmon Event ID 10)." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Ensure the vulnerability is remediated and the hunt results are recorded.", "instructions": "Record the findings. Verify that the Apache ActiveMQ instance has been patched to version 5.18.3 or later." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }