Case of ActiveMQ Vulnerability Exploitation to Install Sharpire (Kinsing)

Description

The Kinsing threat actor continues to distribute malware by exploiting known vulnerabilities, particularly CVE-2023-46604 in ActiveMQ. They target both Linux and Windows systems, using various malware types including XMRig, Stager, and Sharpire. The attack process involves exploiting the ActiveMQ vulnerability to execute remote commands, installing downloaders, and using tools like CobaltStrike, Meterpreter, and PowerShell Empire to control infected systems. The actor's main objectives include cryptocurrency mining, information theft, and potential ransomware installation. The vulnerability has also been exploited by other groups such as Andariel, HelloKitty, and Mauri ransomware. Organizations are advised to apply security updates to mitigate the risk.