ClosedCriticalPatched
Day · Nov 1, 2023
Apache ActiveMQ OpenWire RCE exploited for HelloKitty ransomware (CVE-2023-46604)
Apache ActiveMQ (Java OpenWire brokers and clients)
Updates on Nov 1, 2023
Rapid7 reports exploitation in two customer environments, attempting to deploy HelloKitty ransomware
Source
Summary
A deserialization flaw in ActiveMQ's Java OpenWire protocol marshaller let anyone who could reach a broker run shell commands on it. Within days of the fix, attackers were deploying HelloKitty ransomware through it.
Read the full incident →
