A novel attack technique has emerged as hackers exploit a critical vulnerability in Apache ActiveMQ, identified as CVE-2023-46604, which carries a CVSS score of 10.0. Security researchers at Red Canary have observed that attackers not only gained unauthorized access to Linux servers running this popular open-source middleware but also installed a new malware variant known as DripDropper that subsequently patches the very flaw exploited for access. Brian Donohue, a principal researcher at Red Canary, remarked, 'This kind of behavior is very uncommon; we see it very rarely.' The attackers, using the Sliver implant, modified the sshd configuration to enable root access and installed DripDropper, which communicates with an attacker-controlled Dropbox account to maintain control over compromised systems.
The vulnerability in question, CVE-2023-46604, allows for remote code execution and has been publicly known since October 2023. Despite the availability of patches, many systems remain vulnerable, leading to increased exploitation. 'It's unusual to see adversaries 'fix' the very systems they've compromised, but this strategy ensures their access stays exclusive and makes initial exploitation harder to trace,' stated the Red Canary team. The DripDropper malware's unique behavior of patching the exploited vulnerability serves two purposes: it locks out other malicious actors and conceals the attacker's presence.
The attack chain begins with the exploitation of the Apache ActiveMQ vulnerability, allowing attackers to run arbitrary shell commands on affected systems. Once inside, the attackers install DripDropper, which is an encrypted PyInstaller-built executable. This malware is designed to operate covertly, maintaining persistence and allowing for long-term command and control. The malicious actors have also been observed modifying existing sshd configurations to grant themselves elevated access, facilitating further exploitation.
In response to these developments, the security community is urging immediate updates and patching of vulnerable systems. Security teams are advised to implement defensive measures and monitor for signs of exploitation. The Apache Software Foundation has previously addressed the vulnerability, yet many organizations have not applied the necessary updates. Security experts emphasize the importance of maintaining patch discipline, noting that simple measures could have prevented the current exploitation.
Organizations running Apache ActiveMQ are strongly encouraged to update to the latest versions and apply all available security patches to mitigate the risk of exploitation. 'Patching the vulnerability does not disrupt their operations as they have already established other persistence mechanisms for continued access,' noted Red Canary researchers. As this situation evolves, vigilance and proactive security measures remain critical.
