Wednesday, November 6, 2024
HomeCryptocurrency hackKinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

Published on

Malware protection

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining attacks in the cloud.

Unlike on-premises infrastructure, whereby it is difficult to scale up resources, cloud environments enable attackers to deploy resources for cryptomining rapidly, making exploitation easier. 

One of the most common threats of cloud cryptomining is “Kinsing malware.”

- Advertisement - SIEM as a Service

Cybersecurity researchers recently discovered that Kinsing malware has been actively attacking the Apache Tomcat server with vulnerabilities.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

Technical Analysis

Malware families such as Kinsing, a longstanding malware family, specialize in Linux-based cloud infrastructure and aim to gain unauthorized access by exploiting vulnerabilities. 

In most cases, hackers behind Kinsing use compromised systems to install backdoors or cryptominers.

Kinsing once it infects a system, uses system resources for cryptomining, leading to increased costs and reduced server performance.

The latest findings show that the group has been attacking Apache Tomcat servers through Kinsing malware and hiding in filesystems, such as their persistence, by using any innocent file location.

These campaigns use containers and servers’ flaws to install malicious backdoors and cryptominers.

In this instance, many servers were infected simultaneously within one environment, including an Apache Tomcat server with severe vulnerabilities.

Apache Tomcat, an open-source server that publishes static content to the public, is a tempting target for Kinsing perpetrators.

To remain hidden, the Kinsing malware uses uncommon tricks to appear as a file on any system in places where one would never think of looking.

It is found in four areas and here below we have mentioned them:-

  • /var/cache/man/cs/cat1/ (where the user command manpages are usually)
  • /var/cache/man/cs/cat3/ (where the library function manpages are usually)
  • /var/lib/gssproxy/rcache/ (no description)
  • /var/cache/man/zh_TW/cat8/ (here experts find sysadmin commands, but amongst them, there’s also a Taiwan/Chinese directory structure added)

The assumption is that defenders rarely take a critical look at such locations for malicious files due to using the ‘man’ or ‘manual’ page directories and dummy locale folder, consequently making them ideal hiding spots for Kinsing.

To evade discovery, the Kinsing malware is hidden within areas where legitimate system files are usually found.

Attackers increase the chances of their malware being unnoticed on compromised systems by using such innocent-looking routes.

The detected malicious file was not new, and it was first seen in China in late 2022. 

However, this specific attack on the Tomcat server began in mid-2023 with file creation dates from June to July 2023 over a year of an undetected malicious operation. 

The malware uses old version 6.12.2 of XMRig cryptominer, which mines privacy-focused Monero cryptocurrency. GitHub already has the current version 6.21.2 for downloading.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Google Patches High-Severity Vulnerabilities in Chrome

Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities....

ClickFix Exploits GMeet & Zoom Pages to Deliver Sophisticated Malware

A new tactic, "ClickFix," has emerged. It exploits fake Google Meet and Zoom pages...

APT36 Hackers Attacking Windows Deevices With ElizaRAT

APT36, a sophisticated threat actor, has been actively targeting Indian entities with advanced malware...

Hackers Using AV/EDR Bypass Tool From Cybercrime Forums To Bypass Endpoints

Researchers uncovered two previously unknown endpoints with older Cortex XDR agents that used to...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Google Patches High-Severity Vulnerabilities in Chrome

Google has released a new update for its Chrome browser, addressing two high-severity vulnerabilities....

Google Patched 40 Security Vulnerabilities Along With Two Zero-Days

Google has released a batch of security updates addressing 40 vulnerabilities, two of which...

A Massive Hacking Toolkit From “You Dun” Threat Group Developed To Lauch Massive Cyber Attack

The "You Dun" hacking group exploited vulnerable Zhiyuan OA software using SQL injection, leveraging...