Apache ActiveMQ Exploit Leads to LockBit Ransomware

Collection of DFIR Report incident write-ups describing multiple ransomware intrusions and malware campaigns driven by exploitation of internet-exposed services and weak remote access. Notable incidents include an Apache ActiveMQ RCE exploit (CVE-2023-46604) leading to LockBit deployment via a Java Spring gadget, Confluence template-injection exploitation (CVE-2023-22527) leading to ransomware, RDP-based access (including password-spray/single successful logon) leading to RansomHub and Lynx deployments, SEO-poisoning and Bumblebee leading to Akira, a new PHP-based Interlock RAT variant, and 's