Mauri Ransomware Threat Actors Exploiting Apache ActiveMQ Vulnerability (CVE-2023-46604) - ASEC
Tags
attack-pattern: Data Direct Keylogging - T1056.001 Keylogging - T1417.001 Malware - T1587.001 Malware - T1588.001 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Tool - T1588.002 Vulnerabilities - T1588.006 Connection Proxy - T1090 Powershell - T1086
Show in Graph
Common Information
Type Value
UUID cb5946ad-da13-4721-8888-3a9c0e23e57b
Fingerprint 94b89658a357ac87
Analysis status DONE
Considered CTI value 1
Text language
Published Dec. 1, 2024, 3 p.m.
Added to db Dec. 6, 2024, 3:14 a.m.
Last updated Dec. 17, 2024, 7:48 a.m.
Headline Mauri Ransomware Threat Actors Exploiting Apache ActiveMQ Vulnerability (CVE-2023-46604)
Title Mauri Ransomware Threat Actors Exploiting Apache ActiveMQ Vulnerability (CVE-2023-46604) - ASEC
Detected Hints/Tags/Attributes 76/1/12
Source URLs
Redirection Url
Details Source https://asec.ahnlab.com/en/85000/
URL Provider
Details Provider Source level domain
Details ahnlab.com asec.ahnlab.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 17 ✔ ASEC https://asec.ahnlab.com/en/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CVE 91 
cve-2023-46604
Details Domain 2 
user.zip
Details File 2 
pocw.xml
Details File 2 
user.zip
Details File 62 
2.exe
Details File 4 
user.bat
Details File 6 
read_to_decrypt.html
Details File 6 
files_encrypted.html
Details IPv4 4 
18.139.156.111
Details IPv4 14 
1.3.0.0
Details Url 3 
http://18.139.156.111:83/pocw.xml
Details Url 3 
https://t.me/calojohn666