MITRE ATT&CKsoftware (malware)
S0599 Kinsing
- Domain
- enterprise
- Platforms
- Containers, Linux
- Version
- 1.1
- Created
- 2021-04-06
Description
Kinsing is Golang-based malware that runs a cryptocurrency miner and attempts to spread itself to other hosts in the victim environment.
Related
Uses · MITRE ATT&CK (17)
- T1496.001 Compute Hijacking sub-technique
- T1609 Container Administration Command technique
- T1610 Deploy Container technique
- T1071.001 Web Protocols sub-technique
- T1059.004 Unix Shell sub-technique
- T1021.004 SSH sub-technique
- T1222.002 Linux and Mac Permissions sub-technique
- T1552.003 Shell History sub-technique
- T1552.004 Private Keys sub-technique
- T1053.003 Cron sub-technique
- T1018 Remote System Discovery technique
- T1057 Process Discovery technique
- T1078 Valid Accounts technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1110 Brute Force technique
- T1133 External Remote Services technique
References
- https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability Aqua Kinsing April 2020
- https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi/ Sysdig Kinsing November 2020
- https://info.aquasec.com/hubfs/Threat%20reports/AquaSecurity_Cloud_Native_Threat_Report_2021.pdf?utm_campaign=WP%20-%20Jun2021%20Nautilus%202021%20Threat%20Research%20Report&utm_medium=email&_hsmi=132931006&_hsenc=p2ANqtz-_8oopT5Uhqab8B7kE0l3iFo1koirxtyfTehxF7N-EdGYrwk30gfiwp5SiNlW3G0TNKZxUcDkYOtwQ9S6nNVNyEO-Dgrw&utm_content=132931006&utm_source=hs_automation Aqua Security Cloud Native Threat Report June 2021