“TellYouThePass”, a ransomware variant first discovered in 2019, has resurfaced by affecting internet facing Apache ActiveMQ Servers using CVE-2023-46604. This is a critical vulnerability (with a CVSS Score of 10/10) published in late October 2023 that has already seen a great amount of use. This vulnerability allows for malicious actors to remote execute shell commands on the affected server version. On November 1, 2023, researchers released a report detailing how CVE-2023-46604 was being exploited to install “HelloKitty” ransomware on client Apache ActiveMQ servers while additional researchers identified evidence of this CVE being used to deploy “SparkRAT” malware. According to researchers, TellYouThePass has been deployed onto Apache ActiveMQ servers using the same techniques, file encryption flow, and file enumeration flow as HelloKitty. Additionally, a number of Bitcoin Wallets, IP Addresses, and email addresses were shared between the TellYouThePass and HelloKitty attacks utilizing CVE-2023-46604. For ActiveMQ servers, the attack is initiated through an HTTP request to the server. This creates a CMD process that is then used to download two (2) files that lead to the dropping of a .NET DLL to the system. This DLL does not use obfuscation, which allowed researchers to see its similarity with earlier versions of TellYouThePass. The ransomware then attempts to delete VSS snapshots to make system recovery more difficult before the ransom note titled “READ_ME4.html” is released after the system has been successfully encrypted. Apache has already released a patch for this CVE and is directing its customers to immediately update their environments. Despite this, there are still over 9,200 Apache ActiveMQ servers that are facing the internet with more than half of them still vulnerable to CVE-2023-46604 as of November 5, 2023. CTIX recommends that organizations update any Apache systems or devices currently being utilized to combat this vulnerability and ransomware. Additionally, CTIX will continue to monitor the ongoing ransomware campaigns involved with this vulnerability including the deployment of TellYouThePass.