Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining attacks in the cloud.

Unlike on-premises infrastructure, whereby it is difficult to scale up resources, cloud environments enable attackers to deploy resources for cryptomining rapidly, making exploitation easier. 

One of the most common threats of cloud cryptomining is “Kinsing malware.”

Cybersecurity researchers recently discovered that Kinsing malware has been actively attacking the Apache Tomcat server with vulnerabilities.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

Technical Analysis

Malware families such as Kinsing, a longstanding malware family, specialize in Linux-based cloud infrastructure and aim to gain unauthorized access by exploiting vulnerabilities. 

In most cases, hackers behind Kinsing use compromised systems to install backdoors or cryptominers.

Kinsing once it infects a system, uses system resources for cryptomining, leading to increased costs and reduced server performance.

The latest findings show that the group has been attacking Apache Tomcat servers through Kinsing malware and hiding in filesystems, such as their persistence, by using any innocent file location.

These campaigns use containers and servers’ flaws to install malicious backdoors and cryptominers.

In this instance, many servers were infected simultaneously within one environment, including an Apache Tomcat server with severe vulnerabilities.

Apache Tomcat, an open-source server that publishes static content to the public, is a tempting target for Kinsing perpetrators.

To remain hidden, the Kinsing malware uses uncommon tricks to appear as a file on any system in places where one would never think of looking.

It is found in four areas and here below we have mentioned them:-

• /var/cache/man/cs/cat1/ (where the user command manpages are usually)

• /var/cache/man/cs/cat3/ (where the library function manpages are usually)

• /var/lib/gssproxy/rcache/ (no description)

• /var/cache/man/zh_TW/cat8/ (here experts find sysadmin commands, but amongst them, there’s also a Taiwan/Chinese directory structure added)

The assumption is that defenders rarely take a critical look at such locations for malicious files due to using the ‘man’ or ‘manual’ page directories and dummy locale folder, consequently making them ideal hiding spots for Kinsing.

To evade discovery, the Kinsing malware is hidden within areas where legitimate system files are usually found.

Attackers increase the chances of their malware being unnoticed on compromised systems by using such innocent-looking routes.

The detected malicious file was not new, and it was first seen in China in late 2022. 

However, this specific attack on the Tomcat server began in mid-2023 with file creation dates from June to July 2023 over a year of an undetected malicious operation. 

The malware uses old version 6.12.2 of XMRig cryptominer, which mines privacy-focused Monero cryptocurrency. GitHub already has the current version 6.21.2 for downloading.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers