Kinsing is a Linux-focused cryptomining malware family associated with opportunistic exploitation of exposed or vulnerable internet-facing services and subsequent deployment of cryptocurrency miners, commonly for Monero mining. It is typically delivered through shell-script-based intrusion chains after remote code execution on misconfigured or unpatched systems, including containerized and cloud-hosted workloads. Reported exploitation paths linked to Kinsing activity include vulnerabilities in products such as JetBrains TeamCity, Apache ActiveMQ, Ivanti Sentry, and PHPUnit, as well as abuse of exposed Docker daemon APIs.
Kinsing is commonly described as a Go-compiled ELF payload that may launch secondary miner-related processes and aggressively monopolize host CPU resources. Its operators use bash scripts to download and execute the malware, remove competing miners, clear traces, and establish persistence. Persistence is frequently achieved through cron job creation or cron file modification. Kinsing-related activity has also included disabling or interfering with security tooling and terminating rival cryptomining processes to retain exclusive access to system resources.
Beyond mining, Kinsing has demonstrated worm-like post-compromise behavior on Linux systems. Documented tradecraft includes SSH brute forcing, use of valid SSH credentials for lateral movement, and parsing of host and SSH trust data to identify additional reachable systems. Kinsing has also been observed using SSH for lateral movement and conducting follow-on reconnaissance in compromised environments. In some intrusion clusters associated with vulnerable edge or application infrastructure, Kinsing infections appeared alongside broader post-exploitation activity such as internal scanning and network discovery.
Kinsing primarily targets Linux servers, containers, and cloud-exposed workloads, especially systems with weak exposure management or exploitable remote services. It is widely tracked as a commodity but effective cryptojacking threat in the Linux ecosystem and is frequently referenced alongside other Linux-focused miner operations such as TeamTNT, Rocke, WatchDog, and Outlaw due to overlapping targeting and anti-competition behavior.
