Apache ActiveMQ Exploit Leads to LockBit Ransomware

Back Thedfirreport

Apache ActiveMQ Exploit Leads to LockBit Ransomware

Thedfirreport • February 23, 2026

Share: View original

A threat actor exploited CVE-2023-46604 on an internet-facing Apache ActiveMQ server. Despite being evicted after the initial intrusion, ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache ActiveMQ Vulnerability Exploited for LockBit Ransomware Attack Threat actors exploited a critical vulnerability (CVE-2023-46604) in Apache ActiveMQ, leading to a LockBit ransomware deployment across an enterprise network. The attackers gained access through an exposed Windows server using Remote Desktop Protocol, resulting in significant system encryption. Despite efforts to evict the intruders, the ransomware spread rapidly within the network. 3 sources 53

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

T1190 - Exploit Public-Facing Application

Platforms (1)

Apache ActiveMQ

Ransomware Groups (1)