Exploitation of CVE-2023-46604 Leading to Ransomware

Arctic Wolf Labs observed active in-the-wild exploitation of an Apache ActiveMQ RCE (CVE-2023-46604) beginning Oct 10, 2023, used to deploy SparkRAT and a Golang ransomware family (HelloKittyCat/TellYouThePass) on Windows and Linux; the report includes binary comparisons, detailed attack chains, IoCs (IPs, domains, file hashes, bitcoin address), and network/endpoint detection and mitigation recommendations.