The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added an actively exploited Apache RocketMQ critical zero-day vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. RocketMQ is a high-performance distributed messaging and streaming platform. The flaw, tracked as CVE-2023-33246, is a permission verification vulnerability that allows unauthenticated threat actors to conduct remote code execution (RCE) to deliver various malware payloads to vulnerable instances of RocketMQ. This flaw was exploited in early June 2023 by operators of the DreamBus botnet, deploying a cryptocurrency miner for the anonymous Monero (XMR) coin. The DreamBus module is highly sophisticated, passing all VirusTotal antivirus (AV) scans undetected by downloading a Tor-based proxy service bash script named “reketed” and deleting itself after execution. Once installed, DreamBus sets up a system service and an automated cron job which executes hourly to maintain persistence. DreamBus scans the network and moves laterally to search for other vulnerabilities that could allow the threat actors to conduct additional malicious activity. This vulnerability is exploitable due to a design flaw causing multiple RocketMQ components to be exposed and accessible on the public internet. The flaw has been patched by Apache maintainers, and CTIX analysts urge any impacted users to ensure they are running the most secure version of the platform to prevent exploitation. The presence of this flaw on CISA’s KEV mandates that all Federal Civilian Executive Branch (FCEB) agencies patch the vulnerability by no later than September 27, 2023, or face being held accountable by regulatory agencies.