Within the opening weeks of 2024, a resurgence in the exploitation of CVE-2023-46604, a now patched vulnerability for Apache ActiveMQ hosts that allows for remote code execution, has been witnessed. Discovered in October 2023, researchers have noticed an uptick in the vulnerability’s usage of Java Server Pages (JSP)-based web shells that are placed into the ActiveMQ installation directory, specifically the “Admin” folder. This JSP code was identified to have come from Godzilla Web Shell, an open-source web shell. Godzilla is unique in that it utilizes an “unknown type of binary” to keep itself hidden from any scanners. Once installed, Godzilla can be used to connect to the web shell. This allows the threat actor to gain control of the infected system. This leads to a variety of capabilities that the threat actor can use to further acquire sensitive information and expand control throughout the network. These include port and network scanning abilities, executing, and running Mimikatz and Meterpreter commands, executing shell commands, and many others. This gives threat actors a high degree of versatility in their next actions once Godzilla is deployed onto a system. This campaign highlights once again the importance of keeping systems up to date, as this exploit has been patched for some time already. CTIX analysts will continue to monitor the development of Godzilla and any further exploitations regarding Apache ActiveMQ.