Tuesday, June 25, 2024

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining attacks in the cloud.

Unlike on-premises infrastructure, whereby it is difficult to scale up resources, cloud environments enable attackers to deploy resources for cryptomining rapidly, making exploitation easier. 

One of the most common threats of cloud cryptomining is “Kinsing malware.”

Cybersecurity researchers recently discovered that Kinsing malware has been actively attacking the Apache Tomcat server with vulnerabilities.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

Technical Analysis

Malware families such as Kinsing, a longstanding malware family, specialize in Linux-based cloud infrastructure and aim to gain unauthorized access by exploiting vulnerabilities

In most cases, hackers behind Kinsing use compromised systems to install backdoors or cryptominers.

Kinsing once it infects a system, uses system resources for cryptomining, leading to increased costs and reduced server performance.

The latest findings show that the group has been attacking Apache Tomcat servers through Kinsing malware and hiding in filesystems, such as their persistence, by using any innocent file location.

These campaigns use containers and servers’ flaws to install malicious backdoors and cryptominers.

In this instance, many servers were infected simultaneously within one environment, including an Apache Tomcat server with severe vulnerabilities.

Apache Tomcat, an open-source server that publishes static content to the public, is a tempting target for Kinsing perpetrators.

To remain hidden, the Kinsing malware uses uncommon tricks to appear as a file on any system in places where one would never think of looking.

It is found in four areas and here below we have mentioned them:-

  • /var/cache/man/cs/cat1/ (where the user command manpages are usually)
  • /var/cache/man/cs/cat3/ (where the library function manpages are usually)
  • /var/lib/gssproxy/rcache/ (no description)
  • /var/cache/man/zh_TW/cat8/ (here experts find sysadmin commands, but amongst them, there’s also a Taiwan/Chinese directory structure added)

The assumption is that defenders rarely take a critical look at such locations for malicious files due to using the ‘man’ or ‘manual’ page directories and dummy locale folder, consequently making them ideal hiding spots for Kinsing.

To evade discovery, the Kinsing malware is hidden within areas where legitimate system files are usually found.

Attackers increase the chances of their malware being unnoticed on compromised systems by using such innocent-looking routes.

The detected malicious file was not new, and it was first seen in China in late 2022. 

However, this specific attack on the Tomcat server began in mid-2023 with file creation dates from June to July 2023 over a year of an undetected malicious operation. 

The malware uses old version 6.12.2 of XMRig cryptominer, which mines privacy-focused Monero cryptocurrency. GitHub already has the current version 6.21.2 for downloading.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers


Latest articles

Hackers Exploit Multiple WordPress Plugins to Hack Websites & Create Rogue Admin Accounts

Wordfence Threat Intelligence team identified a significant security breach involving multiple WordPress plugins. The initial...

Hackers Attacking Windows IIS Server to Upload Web Shells

Windows IIS Servers often host critical web applications and services that provide a gateway...

WikiLeaks Founder Julian Assange Released in Stunning Deal with U.S.

WikiLeaks founder Julian Assange has been released from prison after reaching a deal with...

Four Members of FIN9 Hackers Charged for Attacking U.S. Companies

Four Vietnamese nationals have been charged for their involvement in a series of computer...

BREAKING: NHS England’s Synnovis Hit by Massive Cyber Attack

In a shocking development, the NHS has revealed that it was the victim of...

Threat Actor Claiming a 0-day in Linux LPE Via GRUB bootloader

A new threat actor has emerged, claiming a zero-day vulnerability in the Linux GRUB...

LockBit Ransomware Group Claims Hack of US Federal Reserve

The notorious LockBit ransomware group has claimed responsibility for hacking the U.S. Federal Reserve,...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles