APACHE ACTIVEMQ FLAW EXPLOITED TO DEPLOY DRIPDROPPER MALWARE ON CLOUD LINUX SYSTEMS

Summary from the TLDR InfoSec newsletter

Threat actors are exploiting a two-year-old critical Apache ActiveMQ vulnerability (CVE-2023-46604, CVSS 10.0) to deploy DripDropper malware on cloud Linux systems, then patching the flaw post-compromise to block other attackers and evade detection. The attackers use the PyInstaller-based DripDropper to establish persistence through modified SSH configurations and cron jobs, while leveraging legitimate services like Dropbox and Cloudflare Tunnels for command-and-control communications.