1. Home
  2. Software
  3. Kinsing

Kinsing

Kinsing is Golang-based malware that runs a cryptocurrency miner and attempts to spread itself to other hosts in the victim environment. [1][2][3]

ID: S0599
ⓘ
Type: MALWARE
ⓘ
Platforms: Containers, Linux
Contributors: Center for Threat-Informed Defense (CTID)
Version: 1.1
Created: 06 April 2021
Last Modified: 26 August 2021
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1059 .004 命令与脚本解释器: Unix Shell

Kinsing has used Unix shell scripts to execute commands in the victim environment.[1]
Enterprise T1133 外部远程服务

Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.[1]
Enterprise T1609 容器管理命令

Kinsing was executed with an Ubuntu container entry point that runs shell scripts.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

Kinsing has communicated with C2 over HTTP.[1]
Enterprise T1083 文件和目录发现

Kinsing has used the find command to search for specific files.[1]
Enterprise T1222 .002 文件和目录权限修改: Linux and Mac File and Directory Permissions Modification

Kinsing has used chmod to modify permissions on key files for use.[1]
Enterprise T1110 暴力破解

Kinsing has attempted to brute force hosts over SSH.[1]
Enterprise T1078 有效账户

Kinsing has used valid SSH credentials to access remote hosts.[1]
Enterprise T1552 .003 未加密凭证: Bash History

Kinsing has searched bash_history for credentials.[1]
.004 未加密凭证: Private Keys

Kinsing has searched for private keys.[1]
Enterprise T1496 .001 资源劫持: Compute Hijacking

Kinsing has created and run a Bitcoin cryptocurrency miner.[1][2]
Enterprise T1105 输入工具传输

Kinsing has downloaded additional lateral movement scripts from C2.[1]
Enterprise T1057 进程发现

Kinsing has used ps to list processes.[1]
Enterprise T1021 .004 远程服务: SSH

Kinsing has used SSH for lateral movement.[1]
Enterprise T1018 远程系统发现

Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.[1]
Enterprise T1610 部署容器

Kinsing was run through a deployed Ubuntu container.[1]
Enterprise T1053 .003 预定任务/作业: Cron

Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.[1]

References

  1. Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.
  2. Huang, K. (2020, November 23). Zoom into Kinsing. Retrieved April 1, 2021.
  1. Team Nautilus. (2021, June). Attacks in the Wild on the Container Supply Chain and Infrastructure. Retrieved August 26, 2021.