ActiveMQ Java Process Starts Certutil To Download A File

Daniel Jeremiah@daniyyell

•updated Feb 26, 2026•2•0•66

Detects a Java process starting certutil to download a file from the internet. This is unusual for a message broker and can indicate a server has been taken over and is pulling down a payload.