EHA
Home cryptocurrency Kinsing Malware Attacking Apache Tomcat servers to Deploy cryptominers

Kinsing Malware Attacking Apache Tomcat servers to Deploy cryptominers

0

Cloud platforms’ scalability and flexibility are making cloud cryptomining a growing security concern. The ease of resource deployment allows attackers to quickly infiltrate cloud environments for cryptomining purposes. 

Kinsing malware is a particularly prevalent threat, exploiting cloud vulnerabilities to leverage processing power for cryptocurrency mining. 

It is known for targeting Linux cloud systems and has expanded its attack range to include Apache Tomcat servers, where attackers exploit vulnerabilities to gain unauthorized access and deploy backdoors and cryptominers. 

Kinsing utilizes new stealth techniques to hide on the filesystem, including leveraging seemingly innocuous locations for persistence, which allows Kinsing to mine cryptocurrency on compromised systems undetected, leading to increased costs and performance degradation. 

It also exploits vulnerabilities in servers to deploy backdoors and cryptominers, and it infects Apache Tomcat servers, which are attractive targets due to their internet accessibility. 

Kinsing hides itself in atypical locations to evade detection, including system directories for user-level commands (/var/cache/man/cs/cat1/ and /var/cache/man/cs/cat3/) and a directory likely created for persistence (/var/cache/man/zh_TW/cat8/), which demonstrates a sophisticated attacker leveraging obscurity to gain a foothold on compromised systems. 

 version of XMRig is 6.12.2

An attacker cleverly concealed malicious software within standard system directories (var/cache/man) on a Tomcat server, where malware is disguised as legitimate system files, allowing the attacker’s malware to remain undetected for nearly a year. 

According to Tenable, the malware specifically targeted the Tomcat server, a widely-used open-source Java servlet container for web applications. 

By exploiting the server, the attacker gained unauthorized access to computational resources, and the malicious code embedded within the disguised files contained an outdated version (6.12.2) of XMRig, a well-known cryptominer for the Monero cryptocurrency. 

XMRig utilizes a computer’s central processing unit (CPU) to perform complex mathematical calculations to mine cryptocurrency, as the attacker illicitly leveraged the victim’s computational resources for their own financial gain by mining Monero cryptocurrency.

NO COMMENTS

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Exit mobile version