UPDATE: A threat actor known as Andariel, believed to be a member or partner of the North Korean state sponsored threat group Lazarus, has been identified in a cyberattack campaign targeting South Korean entities to spread the NukeSped and TigerRat backdoors. Andariel is known for targeting “national defense, political groups, shipbuilding, energy, telecommunications, ICT firms, universities, and logistics firms.” The threat actors were able to install the backdoors by exploiting a critical remote code execution (RCE) vulnerability in Apache ActiveMQ, tracked as CVE-2023-46604. ActiveMQ is an open-source protocol which functions as an implementation of message-oriented middleware (MOM), allowing different applications to send messages between each other. Specifically, the flaw exists in the Java OpenWire protocol marshaller, allowing remote attackers with network access to Java-based OpenWire brokers or clients to run arbitrary shell commands by manipulating class types. Once installed, the backdoors communicate with Andariel command-and-control (C2) servers, allowing the threat actors to take complete administrative control of compromised systems. The exploited vulnerability has been patched, however threat actors knowing that many organizations are slow to patch, are actively scanning and attacking vulnerable versions of ActiveMQ. CTIX analysts recommend that any administrators responsible for infrastructure that may be vulnerable should ensure that their instances of Apache ActiveMQ are running the most recent software version.
- GBHackers On Security: Apache ActiveMQ Vulnerability Article
- Apache: ActiveMQ Vulnerability Notification