← Back to Feed
Apache ActiveMQ Exploit Leads to LockBit Ransomware
CVE-2023-46604
February 23, 2026 · DFIR Report · Severity: CRITICAL
Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an exposed Apache ActiveMQ server.
Key Takeaways
- Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible.
- The threat actor was able to perform remote code execution (RCE) by using a Java Spring class and a custom Java.