{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "This hunt addresses the critical gap between re-exploitation and ransomware deployment. Since the actor transitioned to ransomware in less than 90 minutes during the second phase, a negative result provides immediate assurance against an active LockBit campaign." }, "name": "Apache ActiveMQ Lateral Movement and Ransomware Impact", "type": "investigation", "labels": [ "hunt", "attack.t1021.001", "attack.t1021.002", "attack.t1486", "attack.t1543.003", "attack.t1078" ], "series": { "slug": "apache-activemq-exploit-leads-to-lockbit-ransomware", "index": 3, "title": "Apache ActiveMQ Exploit Leads to LockBit Ransomware", "total": 3 }, "related": [ { "hunt": "activemq-initial-rce-exploitation", "reason": "The initial exploit of CVE-2023-46604 via malicious XML/Java Spring classes is handled by a separate hunt focused on web server logs and ingress.", "relation": "out-of-scope-alternative" }, { "hunt": "activemq-exploitation-metasploit-staging", "relation": "follows" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] }, "identity": { "name": "Identity / sign-in telemetry", "category": "identity", "telemetry": [ "identity" ] } }, "analysis": "While a rule might alert on any process with a '-pass' flag, this hunt correlates that signal with ActiveMQ server locations and RDP authentication patterns across a specific 14-day window, distinguishing targeted intrusion from administrative noise.", "coverage": [ { "stage": "lateral-movement-rdp", "steps": [ "rdp-movement" ], "status": "covered" }, { "stage": "lockbit-ransomware-deployment", "steps": [ "lockbit-execution" ], "status": "covered" }, { "stage": "activemq-rce-exploitation", "reason": "This hunt starts post-compromise at the lateral movement phase; initial access is covered by a sibling hunt.", "status": "out_of_scope" }, { "stage": "metasploit-payload-ingress", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "local-privilege-escalation", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "credential-dumping-lsass", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "internal-discovery-and-persistence", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-and-log-clearing", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Apache ActiveMQ RCE Exploitation", "slug": "activemq-rce-exploitation", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "CVE-2023-46604", "org.springframework.context.support.ClassPathXmlApplicationContext", "ActiveMQ server process java.exe parent", "Java Spring bean configuration XML file download" ] }, { "name": "Metasploit Payload Ingress", "slug": "metasploit-payload-ingress", "tactic": "execution", "techniques": [ "T1105", "T1059.003" ], "observables": [ "certutil.exe -urlcache -f", "uFSyLszKsuR.exe", "C:\\Users\\\\AppData\\Local\\Temp\\uFSyLszKsuR.exe", "166.62.100.52" ] }, { "name": "Privilege Escalation via getsystem", "slug": "local-privilege-escalation", "tactic": "privilege-escalation", "techniques": [ "T1134", "T1055" ], "observables": [ "cmd.exe /c echo kesknq > \\\\.\\pipe\\kesknq", "Metasploit stager with SYSTEM level permissions", "Service name kesknq" ] }, { "name": "Credential Access via LSASS Dumping", "slug": "credential-dumping-lsass", "tactic": "credential-access", "techniques": [ "T1003.001" ], "observables": [ "lsass.exe memory access", "GrantedAccess 0x1010 (VMRead)", "CallTrace UNKNOWN indicative of injected code" ] }, { "name": "Internal Discovery and Persistence", "slug": "internal-discovery-and-persistence", "tactic": "discovery", "techniques": [ "T1046", "T1018", "T1133" ], "observables": [ "AnyDesk.exe installation", "AnyDesk Service creation (Event ID 7045)", "Advanced_IP_Scanner.exe", "SMB traffic spikes (network scanning)" ] }, { "name": "Defense Evasion and Log Clearing", "slug": "defense-evasion-and-log-clearing", "tactic": "defense-evasion", "techniques": [ "T1070.001", "T1562.001", "T1218" ], "observables": [ "rdp.bat creation and deletion", "wevtutil cl System", "wevtutil cl Security", "SystemSettingsAdminFlows.exe used to disable Windows Defender", "Injected winlogon.exe creating batch files" ] }, { "name": "Lateral Movement via RDP and Services", "slug": "lateral-movement-rdp", "tactic": "lateral-movement", "techniques": [ "T1021.001", "T1021.002", "T1543.003" ], "observables": [ "RDP connections using privileged service accounts", "Remote service execution of Metasploit payloads", "Firewall modification to allow port 3389" ] }, { "name": "LockBit Ransomware Deployment", "slug": "lockbit-ransomware-deployment", "tactic": "impact", "techniques": [ "T1486" ], "observables": [ "LockBit ransomware binary execution", "Execution with specific path and password flags", "Execution from Downloads folder via double-click" ] } ], "summary": "A threat actor exploited an internet-facing Apache ActiveMQ server using CVE-2023-46604 to execute code via Java Spring bean XML files, subsequently downloading a Metasploit stager using CertUtil. The intrusion involved privilege escalation via getsystem, credential dumping from LSASS, and extensive lateral movement using RDP and remote services before deploying LockBit ransomware." }, "severity": "high", "rationale": "The hunt should begin with systems running Apache ActiveMQ. If logs from 18 days ago are unavailable, focus on current RDP source/destination patterns involving those servers.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An attacker has transitioned from an exploited ActiveMQ server to lateral movement via RDP using stolen credentials, ultimately deploying LockBit ransomware from user-writable directories or with specific execution flags.", "parameters": { "scope_hosts": { "from": { "ref": "activemq-scoping", "kind": "manual", "observed": "2024-02-23" }, "type": "list[host]", "default": [], "description": "Hostnames identified as running ActiveMQ; leave empty to search the entire estate." }, "lookback_days": { "from": { "ref": "hunt-standard", "kind": "manual", "observed": "2024-01-01" }, "type": "number", "default": "14", "description": "Days of history to examine." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/", "name": "The DFIR Report \u2014 Apache ActiveMQ Exploit Leads to LockBit Ransomware" } ], "blind_spots": [ { "id": "rdp-log-rotation", "risk": "Standard 14-day log rotation on many endpoints would hide the actor's initial credential harvesting and movement.", "stage": "lateral-movement-rdp", "question": "Was there lateral movement 18 days ago that has been rotated out of logs?", "requires": "Windows Event Log retention > 21 days" }, { "id": "transient-files", "risk": "The actor deleted the batch file within six minutes; without high-frequency file event collection, the exact commands used to open the RDP firewall ports may be missing.", "stage": "lateral-movement-rdp", "question": "Was the rdp.bat file used and then deleted on the beachhead?", "requires": "hb_file_activity with delete activity" } ] }, "name": "Apache ActiveMQ Lateral Movement and Ransomware Impact", "description": "This hunt focuses on the lateral propagation and impact stages following an Apache ActiveMQ (CVE-2023-46604) compromise. The report highlights that after initial access, the actor extracts credentials to move laterally via RDP and services, eventually deploying LockBit ransomware within a narrow 90-minute window of the second intrusion.\n\nThe hunt first identifies ActiveMQ installations across the estate to scope potential beachheads. It then fanned-out queries to find RDP authentication patterns originating from these hosts and rare process executions that exhibit LockBit-specific traits, such as running from a Downloads directory or using password-protected execution flags. An agent correlates these signals to identify active propagation and impact." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "apache-activemq-exploit-leads-to-lockbit-ransomware", "index": 3, "title": "Apache ActiveMQ Exploit Leads to LockBit Ransomware", "total": 3 }, "coverage": [ { "stage": "lateral-movement-rdp", "steps": [ "rdp-movement" ], "status": "covered" }, { "stage": "lockbit-ransomware-deployment", "steps": [ "lockbit-execution" ], "status": "covered" }, { "stage": "activemq-rce-exploitation", "reason": "This hunt starts post-compromise at the lateral movement phase; initial access is covered by a sibling hunt.", "status": "out_of_scope" }, { "stage": "metasploit-payload-ingress", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "local-privilege-escalation", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "credential-dumping-lsass", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "internal-discovery-and-persistence", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" }, { "stage": "defense-evasion-and-log-clearing", "reason": "Belongs to another part of the 'Apache ActiveMQ Exploit Leads to LockBit Ransomware' series.", "status": "out_of_scope" } ], "rationale": "An attacker has transitioned from an exploited ActiveMQ server to lateral movement via RDP using stolen credentials, ultimately deploying LockBit ransomware from user-writable directories or with specific execution flags.", "blind_spots": [ { "id": "rdp-log-rotation", "risk": "Standard 14-day log rotation on many endpoints would hide the actor's initial credential harvesting and movement.", "stage": "lateral-movement-rdp", "question": "Was there lateral movement 18 days ago that has been rotated out of logs?", "requires": "Windows Event Log retention > 21 days" }, { "id": "transient-files", "risk": "The actor deleted the batch file within six minutes; without high-frequency file event collection, the exact commands used to open the RDP firewall ports may be missing.", "stage": "lateral-movement-rdp", "question": "Was the rdp.bat file used and then deleted on the beachhead?", "requires": "hb_file_activity with delete activity" } ], "scoping_notes": "The hunt should begin with systems running Apache ActiveMQ. If logs from 18 days ago are unavailable, focus on current RDP source/destination patterns involving those servers.", "beyond_detection": "While a rule might alert on any process with a '-pass' flag, this hunt correlates that signal with ActiveMQ server locations and RDP authentication patterns across a specific 14-day window, distinguishing targeted intrusion from administrative noise." } }, { "id": "activemq-scoping", "type": "query", "label": "Identify Apache ActiveMQ Infrastructure", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%activemq%'", "surface": "hb_software_inventory", "description": "Find systems running Apache ActiveMQ to establish the potential starting point for lateral movement.", "expected_signal": "A list of hosts currently running ActiveMQ. Silence means the software is not installed via standard package managers." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify Apache ActiveMQ Infrastructure", "reads": [ "device_hostname", "package_name", "package_version", "install_path" ], "source": "hb_software_inventory", "target": "endpoint", "content": "SELECT DISTINCT device_hostname, package_name, package_version, install_path FROM hb_software_inventory WHERE LOWER(package_name) LIKE '%activemq%'", "silence": "not_evidence_of_absence", "expected": "A list of hosts currently running ActiveMQ. Silence means the software is not installed via standard package managers.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "rdp-movement", "type": "query", "label": "RDP Lateral Movement from Scope", "config": { "dsl": "sqlite", "role": "triage", "source": "identity", "content": "SELECT time, actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol FROM hb_auth_signin WHERE activity_id = 1 AND (LOWER(auth_protocol) LIKE '%rdp%' OR LOWER(activity_name) LIKE '%remote%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_auth_signin", "description": "Detect RDP connections involving the scoped hosts to identify successful lateral movement.", "expected_signal": "Logon events identifying which users moved to which target hosts via RDP." }, "parents": [ { "id": "activemq-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "triage", "label": "RDP Lateral Movement from Scope", "reads": [ "time", "actor_user_name", "src_endpoint_ip", "dst_endpoint_name", "auth_protocol" ], "source": "hb_auth_signin", "target": "identity", "content": "SELECT time, actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol FROM hb_auth_signin WHERE activity_id = 1 AND (LOWER(auth_protocol) LIKE '%rdp%' OR LOWER(activity_name) LIKE '%remote%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Logon events identifying which users moved to which target hosts via RDP.", "verified": "dry-run", "verified_at": "2026-09-23" } }, { "id": "lockbit-execution", "type": "query", "label": "LockBit Ransomware Execution Patterns", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, process_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%-pass%' OR LOWER(process_path) LIKE '%\\downloads\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, process_cmd_line, process_path HAVING host_count <= 3", "surface": "hb_process_activity", "description": "Identify processes executed from user downloads or using password/path flags typical of LockBit deployment.", "expected_signal": "A rare process execution with malicious flags or suspicious paths. Silence suggests no such deployment occurred." }, "parents": [ { "id": "activemq-scoping" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "LockBit Ransomware Execution Patterns", "reads": [ "device_hostname", "process_name", "process_cmd_line", "process_path", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_cmd_line, process_path, COUNT(DISTINCT device_hostname) AS host_count, MIN(time) AS first_seen FROM hb_process_activity WHERE (LOWER(process_cmd_line) LIKE '%-pass%' OR LOWER(process_path) LIKE '%\\downloads\\%') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name, process_cmd_line, process_path HAVING host_count <= 3", "silence": "evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A rare process execution with malicious flags or suspicious paths. Silence suggests no such deployment occurred.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "process_cmd_line" ], "rare_below": 3 }, "verified_at": "2026-09-23" } }, { "id": "triage-impact", "type": "analytic", "label": "Triage TTP Correlation", "config": { "cite": "required", "tools": [ "endpoint", "identity" ], "context": [ "activemq-scoping", "rdp-movement", "lockbit-execution" ], "objective": "Determine if any host in the environment has been accessed via RDP following an ActiveMQ detection and subsequently ran a process from a downloads folder or with password flags.", "description": "Connect the ActiveMQ scope, RDP logins, and rare process executions into a single narrative.", "max_iterations": 5, "expected_signal": "A per-host verdict citing specific rows.", "success_criteria": "A verdict of malicious, suspicious, or benign per host, citing RDP source IPs and process command lines." }, "parents": [ { "id": "rdp-movement", "kind": "merge" }, { "id": "lockbit-execution", "kind": "merge" } ] }, { "id": "route-verdict", "type": "checkpoint", "label": "Route on Impact Verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-impact verdict is malicious for any host, identifying a link between ActiveMQ scoping and ransomware execution", "condition": "the triage-impact verdict is malicious for any host, identifying a link between ActiveMQ scoping and ransomware execution", "blind_spot": "rdp-log-rotation", "confidence": "high", "description": "Direct the hunt based on the agent's findings.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-impact" } ] }, { "id": "isolate-infected-host", "type": "action", "label": "Isolate Endpoint", "config": { "target": "endpoint", "description": "Halt the spread of ransomware by isolating the affected host from the network.", "instructions": "Isolate the identified host immediately using the endpoint agent. Do not reboot the system as memory artifacts may be lost.", "action_approval": "required" }, "parents": [ { "id": "route-verdict", "branch": "on_supports" } ] }, { "id": "manual-triage", "type": "task", "label": "Manual Analyst Review", "config": { "assignee": "analyst", "description": "Verify ambiguous findings and look for transient artifacts like deleted batch files.", "instructions": "Examine the beachhead and target hosts for 'rdp.bat' or any AnyDesk installation. Review the 'lockbit-execution' process results for legitimate administrative tools using similar flags and exclude them from future runs." }, "parents": [ { "id": "route-verdict", "branch": "default" }, { "id": "route-verdict", "branch": "on_unavailable" }, { "id": "isolate-infected-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt Close-out", "config": { "assignee": "analyst", "description": "Document findings and determine if the detection candidate query should be promoted.", "instructions": "Record the outcome of the hunt. If the LockBit execution query identified malicious binaries with high precision, promote it to a standing detection rule." }, "parents": [ { "id": "route-verdict", "branch": "on_refutes" }, { "id": "manual-triage" } ] } ] }