Threat actors have begun leveraging the critical Apache ActiveMQ vulnerability, tracked as CVE-2023-46604, to facilitate the distribution of the Golang-based GoTitan botnet and PrCtrl Rat, a .NET program, as well as the Sliver, Kinsing, and Ddostff malware strains, Hackread reports. Attacks exploiting CVE-2023-46604 to deploy the newly discovered GoTitan botnet involved the usage of the OpenWire protocol to create a connection with the vulnerable ActiveMQ server to eventually prompt the retrieval of a malicious XML file to execute the botnet, a report from Fortinet’s FortiGuard Labs revealed.

Source: SC Magazine