app-artifacts-1305923417.cos.ap-guangzhou.myqcloud.com: a Tencent Cloud bucket listed for ActiveMQ exploit files, and what to check on your server

What app-artifacts-1305923417.cos.ap-guangzhou.myqcloud.com is, and what we know about it

app-artifacts-1305923417.cos.ap-guangzhou.myqcloud.com is not a program on your PC and not a website made for people. It is a storage bucket on Tencent Cloud Object Storage (COS) where someone placed four XML files that URLhaus lists as malware downloads. All four carry the tag ActiveMQ. We found no public write-up of this bucket, so what follows is what URLhaus shows, what our plain request saw, and what Apache and security vendors have published about the attack the files are made for.

1. 1

   What URLhaus lists

   Four file addresses in a folder called zzp: poc.xml, poc_win.xml, t_a.xml and t_e.xml. They were added on 17 October 2026 at 06:06:09 and 06:06:10 UTC by a reporter named drewfink. All four have the threat label malware_download and the tag ActiveMQ. All four were already marked offline in our copy of the data.

2. 2

   What the address itself says

   Tencent Cloud's documentation says a bucket name is made of a name and an APPID joined by a hyphen, and that the APPID is assigned by the system and unique. So app-artifacts is the chosen name, 1305923417 is the account's APPID, and ap-guangzhou is the Guangzhou region. myqcloud.com is Tencent's own domain, registered in 2013 through MarkMonitor, not the attacker's.

3. 3

   What the file names suggest

   poc stands for proof of concept, the usual name in public exploits for this flaw. Public tools for CVE-2023-46604 point a broker at a hosted poc.xml. poc_win.xml looks like a Windows version. What t_a.xml and t_e.xml do is not known. This is our reading of the names, not a fact from a report.

4. 4

   What we could not confirm

   We did not download the files, so we cannot tell you which commands they hold or which payload they fetch next. We do not know whether the bucket was set up by the attacker or belongs to an account that was misused. A harmless sounding name like app-artifacts says nothing about its owner.

Kind of threat

XML files that tell a vulnerable ActiveMQ broker to run commands (exploit stage for CVE-2023-46604, by the tag and the file names)

Where the files were

hxxp://app-artifacts-1305923417.cos.ap-guangzhou.myqcloud[.]com/zzp/ : poc.xml, poc_win.xml, t_a.xml, t_e.xml, plain http

Hosting

Tencent Cloud Object Storage, Guangzhou region; myqcloud.com registered 24 April 2013 through MarkMonitor (Shanghai), RDAP read 17 October 2026

URLhaus entries

4 file addresses, all added 17 October 2026 at 06:06 UTC, all offline in our data

Who is at risk

Owners of Apache ActiveMQ brokers and clients older than 5.15.16, 5.16.7, 5.17.6 or 5.18.3, with OpenWire reachable

Platform

Servers on Windows or Linux running ActiveMQ; not home PCs that never ran a broker

What we checked on 17 October 2026, and what we could not

Our check was one plain request from our server to the bucket's address, with no browser and no clicks. The bucket answered HTTP 403 and named its server tencent-cos. That clears nothing: a storage bucket often refuses a request for its root while single files stay reachable, and these files were already offline.

What happened to this bucket, from the reports to our check

Everything we know happened on one day. The times are UTC and come from the URLhaus rows we hold.

1. Unknown

   The bucket is created

   Tencent Cloud does not publish when a bucket was made, and RDAP covers only myqcloud.com, which is Tencent's domain from 2013. We do not know how long app-artifacts-1305923417 existed before the reports.

2. 17 October 2026, 06:06

   Four XML files are reported

   poc.xml, poc_win.xml and t_e.xml are added at 06:06:09 and t_a.xml at 06:06:10, all by drewfink, all tagged ActiveMQ. Four entries within one second look like one batch report of a folder, not four separate finds.

   

3. 17 October 2026

   Offline, and our request

   In our copy of the data all four files are offline. Our plain request to the bucket the same day gets HTTP 403 from tencent-cos.

What the pattern suggests, and what it does not: the files were reported and taken offline quickly, which fits a short-lived staging place for one campaign. The same attacker can copy them to another bucket in minutes. That is our reading of the dates, not something any report says.

How an XML file can take over an ActiveMQ server

An XML file like poc.xml cannot hurt anyone who opens it in a browser. It is dangerous only to an Apache ActiveMQ broker or client that is tricked into loading it. This is how Apache and the vendors describe the flaw; we did not see these particular files run.

1. 1

   The flaw

   Apache's advisory says the Java OpenWire protocol marshaller in ActiveMQ is open to remote code execution. An attacker with network access to a broker or client can make it create any class on its classpath and so run shell commands. The flaw is CVE-2023-46604, tracked as AMQ-9370, with a CVSS score of 10.0.

2. 2

   The packet

   SonicWall writes that the attacker connects to the OpenWire TCP port 61616 and sends a manipulated command. No password is needed. SonicWall counted over 6,000 exposed vulnerable servers on Shodan in November 2023.

3. 3

   The XML file

   The Hacker News, citing VulnCheck, says attackers used the Spring class ClassPathXmlApplicationContext to load a malicious XML bean configuration file over HTTP. The broker downloads that file from a server such as this bucket and builds what it describes. A bean in the file can start a process with a command.

4. 4

   The command

   The command runs with the rights of the ActiveMQ service. In the cases Rapid7 handled in October 2023, java.exe from the ActiveMQ folder started cmd.exe, which ran msiexec to load files named M2.png and M4.png from a remote server. They were really MSI installers.

5. 5

   The payload

   Rapid7 tied those cases to HelloKitty ransomware, which appended .locked to encrypted files. The Hacker News also names a strain similar to TellYouThePass and the remote access trojan SparkRAT. What the four files on this bucket deliver is not known.

Why two XML files may exist for one target: a Windows broker needs cmd.exe or PowerShell commands, a Linux broker needs bash commands. A file named poc_win.xml beside poc.xml fits that split. It is our reading, and t_a.xml and t_e.xml may be further variants.

Which ActiveMQ versions are affected

The risk is all on the server side. A broker that loaded one of these files ran the attacker's command, so think of it as handed over until you have checked it.

• High

  Ransomware on the broker and beyond

  Rapid7 saw more than half a dozen encryption attempts in one incident and tied it to HelloKitty ransomware. A broker sits in the middle of business systems, so it is a good step into the rest of the network.

• High

  Remote control

  The Hacker News names SparkRAT among the payloads. A remote access trojan on a server gives the attacker a lasting way back in, even after ActiveMQ is upgraded.

• Medium

  Messages and credentials

  The ActiveMQ service can read its configuration, which often holds passwords for databases and other services, and the messages passing through the broker. Treat both as seen.

• Medium

  Hidden traces

  The Hacker News reports that VulnCheck built a quieter method that stays in memory and that the exploit leaves an exception in activemq.log, which attackers then need to clean. A clean log after an attack is therefore not proof.

• Low

  A home PC that shows the name

  If a home PC never ran ActiveMQ, it had nothing to load these files with. A security check that names the host is a warning about the address, not a sign that the PC ran it.

Who meets this address, and how

1. 1

   A server owner with an exposed broker

   Attackers scan the internet for port 61616. A broker that answers and is not patched receives the crafted packet and fetches the XML file from the bucket. This is the case that matters.

2. 2

   A company with ActiveMQ inside another product

   ActiveMQ is built into many business products. If a vendor's product bundles an old ActiveMQ, the product may be exposed even if nobody installed ActiveMQ by name. Ask the vendor which version it ships.

3. 3

   A person who saw the name in a check or a log

   Security tools, DNS filters and lookups such as our /check show the host because it is on a block list. Seeing it there does not mean anything was fetched by your PC.

4. 4

   A researcher

   Public lists like URLhaus are read by defenders who block the host. Fetching the files from a work PC is not needed to protect a server and can set off alarms.

Check your ActiveMQ server before you change anything

Save what you find before you clean up: logs and process lists are the only record of what the XML did.

1. 1

   Find the version

   Look at the folder name or the startup line in activemq.log, for example apache-activemq-5.15.3. Compare it with the table above. Check clients too, because Apache says clients are affected as well.

2. 2

   Check who can reach port 61616

   From outside your network, test whether TCP 61616 answers. If it does and the version is affected, block it at the firewall now, before the upgrade.

3. 3

   Read activemq.log

   Rapid7's test produced a single WARN line, Transport Connection to: tcp://<address> failed, on the 61616 port. The Hacker News says the newer method leaves an exception message. Look for unusual OpenWire errors around the time of any attack.

4. 4

   Look for child processes of java

   On Windows, look in your endpoint tool or event logs for java.exe from the ActiveMQ folder starting cmd.exe, powershell.exe or msiexec.exe. On Linux, look for java starting sh, bash, curl or wget. Rapid7 lists ActiveMQ launching CMD and MSIExec loading over HTTP as the signs.

5. 5

   Search proxy and DNS logs

   Search for app-artifacts-1305923417.cos.ap-guangzhou.myqcloud[.]com and for any request for an .xml file on a myqcloud.com address from the broker. A broker has no reason to fetch XML from a cloud bucket.

6. 6

   Look for ransomware signs

   Rapid7 also names the deletion of volume shadow copies. Files ending in .locked or a ransom note mean the attack went further than one command.

If you use a home PC, a Mac or a phone