{"type":"bundle","id":"bundle--446d3a0a-2614-5cea-85c3-ac60fd76fea1","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"indicator","spec_version":"2.1","id":"indicator--3ad21067-50a8-5ebd-912d-08a4104046ad","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.084890Z","modified":"2026-08-29T13:15:02.084890Z","name":"SIGMA: Apache ActiveMQ RCE (CVE-2023-46604) Spawning LockBit","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'Apache ActiveMQ RCE (CVE-2023-46604) Spawning LockBit']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.084890Z","confidence":95},{"type":"indicator","spec_version":"2.1","id":"indicator--f1ef2023-a3a0-575a-b911-db2d961eb6f5","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.084890Z","modified":"2026-08-29T13:15:02.084890Z","name":"YARA: MAL_RANSOM_LockBit_ActiveMQ_Dropper","indicator_types":["malicious-activity"],"pattern":"[network-traffic:dst_ref.value = 'MAL_RANSOM_LockBit_ActiveMQ_Dropper']","pattern_type":"stix","pattern_version":"2.1","valid_from":"2026-08-29T13:15:02.084890Z","confidence":95},{"type":"report","spec_version":"2.1","id":"report--b1720af7-1736-5ccb-a16e-3c02af2f33a5","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-08-29T13:15:02.084890Z","modified":"2026-10-30T14:11:14.532806Z","name":"Analysis of Apache ActiveMQ Exploit Leads to LockBit Ransomware","description":"Technical threat analysis derived from intelligence published at https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/.\n\nApache ActiveMQ Exploit Leads to LockBit Ransomware Key Takeaways An audio version of this report can be found on Spotify, Apple, YouTube, Audible, & Amazon. This intrusion began in mid-February 2024 after a threat actor exploited a vulnerability (CVE-2023-46604) on an exposed Apache ActiveMQ server. The threat actor was able to perform remote code execution (RCE) by using a Java Spring class and a custom Java Spring […] The post Apache ActiveMQ Exploit Leads to LockBit Ransomware appeared first on The DFIR Report.","published":"2026-08-29T13:15:02.084890Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","indicator--3ad21067-50a8-5ebd-912d-08a4104046ad","indicator--f1ef2023-a3a0-575a-b911-db2d961eb6f5"],"confidence":95}]}