Kinsing
Kinsing is a cybercriminal cryptojacking threat actor, also known as H2Miner, first identified by Alibaba Cloud Security in January 2020. The group is repeatedly associated with opportunistic exploitation of known vulnerabilities and misconfigurations to compromise Linux and Windows systems, with a strong focus on cloud and containerized environments. Reported targets and intrusion paths include exposed or vulnerable Apache ActiveMQ servers via CVE-2023-46604, cloud-focused exploitation of CVE-2023-4911 (Looney Tunables) after initial access via CVE-2017-9841, prior exploitation of Log4Shell (CVE-2021-44228), Docker daemon API misconfigurations, Redis remote code execution vulnerabilities, and stolen SSH credentials for lateral movement. Kinsing has repeatedly abused native Linux utilities, cloud tooling, cron jobs, and SSH persistence to maintain access in compromised environments while deploying cryptominers across cloud infrastructure. Observed persistence and post-exploitation tradecraft includes cron-based persistence, SSH persistence, use of command-line tooling and scripts, and living-off-the-land activity in Linux environments. In ActiveMQ exploitation campaigns, Kinsing has been reported installing XMRig, Stager, and the .NET backdoor Sharpire on both Linux and Windows systems. Sharpire supports PowerShell Empire, and Kinsing activity has also involved Cobalt Strike and Meterpreter for post-exploitation. Reported objectives include unauthorized Monero mining, broader malware installation, information theft, and potential ransomware deployment. Kinsing is specifically described as exploiting CVE-2023-46604 for cryptojacking attacks on Linux and Windows systems, and as actively exploiting CVE-2023-4911 in campaigns aimed at penetrating cloud environments. The actor has also been listed among groups exploiting widely abused vulnerabilities such as CVE-2021-44228 and among botnets or threat actors associated with routinely exploited vulnerabilities. Security reporting cited in the content notes activity affecting cloud infrastructure and systems in Korea.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Abuses native Linux utilities, cloud tooling, cron jobs, and SSH persistence in compromised Linux/cloud environments while deploying cryptominers.
Referenced only as another threat actor observed using XMRig.
Kinsing is a threat actor or operation known for opportunistic cryptomining attacks, now exploiting the React2Shell vulnerability for deploying cryptominers.
Kinsing is a threat actor group conducting cryptojacking attacks by exploiting vulnerabilities such as CVE-2023-46604, deploying backdoors and mining malware.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.