Back Cybersecuritynews

Threat Actors Exploit Apache ActiveMQ Server Vulnerability to Gain RDP Access and Deploy LockBit Ransomware

Cybersecuritynews •Tushar Subhra Dutta • February 25, 2026

A critical vulnerability in Apache ActiveMQ has been actively exploited by threat actors, leading to a full LockBit ransomware deployment across an enterprise network. Attackers leveraged CVE-2023-46604, a remote code execution flaw in the ActiveMQ messaging broker, to break into an exposed Windows server and ultimately encrypt systems via Remote Desktop Protocol — spanning roughly […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Apache ActiveMQ Vulnerability Exploited for LockBit Ransomware Attack Threat actors exploited a critical vulnerability (CVE-2023-46604) in Apache ActiveMQ, leading to a LockBit ransomware deployment across an enterprise network. The attackers gained access through an exposed Windows server using Remote Desktop Protocol, resulting in significant system encryption. Despite efforts to evict the intruders, the ransomware spread rapidly within the network. 3 sources 53

Extracted Entities

Threat Actors Exploit Apache ActiveMQ Server Vulnerability to Gain RDP Access and Deploy LockBit Ransomware

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (2)

Platforms (2)

Ransomware Groups (1)