Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining attacks in the cloud.

Unlike on-premises infrastructure, whereby it is difficult to scale up resources, cloud environments enable attackers to deploy resources for cryptomining rapidly, making exploitation easier. 

One of the most common threats of cloud cryptomining is “Kinsing malware.”

Cybersecurity researchers recently discovered that Kinsing malware has been actively attacking the Apache Tomcat server with vulnerabilities.

ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service

Technical Analysis

Malware families such as Kinsing, a longstanding malware family, specialize in Linux-based cloud infrastructure and aim to gain unauthorized access by exploiting vulnerabilities

In most cases, hackers behind Kinsing use compromised systems to install backdoors or cryptominers.

Kinsing once it infects a system, uses system resources for cryptomining, leading to increased costs and reduced server performance.

The latest findings show that the group has been attacking Apache Tomcat servers through Kinsing malware and hiding in filesystems, such as their persistence, by using any innocent file location.

These campaigns use containers and servers’ flaws to install malicious backdoors and cryptominers.

In this instance, many servers were infected simultaneously within one environment, including an Apache Tomcat server with severe vulnerabilities.

Apache Tomcat, an open-source server that publishes static content to the public, is a tempting target for Kinsing perpetrators.

To remain hidden, the Kinsing malware uses uncommon tricks to appear as a file on any system in places where one would never think of looking.

It is found in four areas and here below we have mentioned them:-

  • /var/cache/man/cs/cat1/ (where the user command manpages are usually)
  • /var/cache/man/cs/cat3/ (where the library function manpages are usually)
  • /var/lib/gssproxy/rcache/ (no description)
  • /var/cache/man/zh_TW/cat8/ (here experts find sysadmin commands, but amongst them, there’s also a Taiwan/Chinese directory structure added)

The assumption is that defenders rarely take a critical look at such locations for malicious files due to using the ‘man’ or ‘manual’ page directories and dummy locale folder, consequently making them ideal hiding spots for Kinsing.

To evade discovery, the Kinsing malware is hidden within areas where legitimate system files are usually found.

Attackers increase the chances of their malware being unnoticed on compromised systems by using such innocent-looking routes.

The detected malicious file was not new, and it was first seen in China in late 2022. 

However, this specific attack on the Tomcat server began in mid-2023 with file creation dates from June to July 2023 over a year of an undetected malicious operation. 

The malware uses old version 6.12.2 of XMRig cryptominer, which mines privacy-focused Monero cryptocurrency. GitHub already has the current version 6.21.2 for downloading.

Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers

Tushar Subhra Dutta

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these systems to steal sensitive data, interrupt…

2 days ago

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a threat actor to read sensitive files…

2 days ago

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes. Resecurity researchers have recently revealed that…

2 days ago

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million Ecuadorian citizens. The announcement was made…

2 days ago

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery efforts following a recent cybersecurity breach.…

3 days ago

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection for Amazon Simple Storage Service (Amazon…

3 days ago