Cybersecurity researchers have issued a warning about a surge in threat actor activity that is taking advantage of a recently patched flaw in Apache ActiveMQ to deliver malicious Godzilla web shells onto compromised systems. This vulnerability, known as CVE-2023-46604, allows for remote code execution and has already been actively exploited to deploy a range of malicious payloads including ransomware, rootkits, cryptocurrency miners, and DDoS botnets.
What makes this attack particularly concerning is the web shells’ ability to remain concealed within an unknown binary format, enabling them to bypass security scanners and evade detection. Once embedded within a vulnerable system, the web shell can be used to run arbitrary shell commands, effectively giving the attacker complete control over the compromised host.
The vulnerability in Apache ActiveMQ messaging systems is critical and should not be taken lightly. Attackers have already leveraged this flaw to execute their attacks on over 3,400 ActiveMQ servers that are accessible from the Internet. It is essential for organizations to apply the necessary patches to protect their systems from exploitation and regularly monitor for any signs of compromise.

Collections

Researchers warn of a surge in threat actor activity exploiting the recently patched Apache ActiveMQ vulnerability (CVE-2023-46604) to deploy malicious Godzilla web shells on compromised systems. The vulnerability allows for remote code execution and has already been used to deploy ransomware, rootkits, cryptocurrency miners, and DDoS botnets. Attackers have targeted over 3,400 ActiveMQ servers accessible from the Internet. Organizations should patch the vulnerability and monitor for compromise.

Apache ActiveMQ Vulnerability Exploited in Godzilla Web Shell Attacks