Kinsing

Family profile

Kinsing is a Linux-focused malware family and associated cryptojacking operation known for compromising internet-exposed servers, containers, and cloud workloads to deploy Monero mining payloads, typically alongside a Go-based backdoor component. It has been observed targeting misconfigured Docker Daemon APIs, exposed Hadoop YARN services, vulnerable Redis and other cloud-native services, and publicly disclosed vulnerabilities including CVE-2017-9841, CVE-2019-19781, CVE-2020-11651, CVE-2020-11652, CVE-2021-44228, and CVE-2023-46604. Activity attributed to Kinsing has also included rapid adoption of newly disclosed flaws and opportunistic exploitation of exposed enterprise and cloud infrastructure.

Operationally, Kinsing commonly uses shell scripts to prepare the host by killing competing miners and malware, disabling security tooling, clearing scheduled tasks used by rivals, and establishing persistence through cron jobs and system services. Multiple campaigns have deployed an XMRig miner together with a Golang RAT or backdoor that supports remote command execution, encrypted command-and-control, SOCKS proxying, scanning, and additional payload delivery. Some variants and related intrusions have shown rootkit-like behavior or preload-based persistence, and Kinsing tradecraft has included process discovery, SSH-based propagation, mass scanning, cron manipulation, integrity checks, and cleanup of shell history to hinder investigation.

Although best known as a cryptominer, Kinsing-associated intrusions have expanded beyond simple resource hijacking. Observed operations include web shell deployment, reverse shell access, exploitation for privilege escalation, reconnaissance of host and cloud environments, and attempts to obtain cloud credentials and instance metadata. Kinsing has been repeatedly associated with attacks on cloud-native and containerized environments, including Kubernetes-related targets, Docker infrastructure, and Linux servers in public cloud environments. The malware is widely tracked as a persistent cloud cryptojacking threat because it combines automated exploitation, backdoor access, persistence, and defense evasion with monetization through illicit cryptocurrency mining.

Capabilities

Defense Evasion
Exfiltration
Lateral Movement
Persistence
Post Exploitation
Privilege Escalation
Reconnaissance
Scanning

Reported operators

Threat actors

1 named in public reporting

TeamTNT

Most notably, TeamTNT was reported to have copied the code used to detect and remove Alibaba Cloud Security from compromised instances from the Kinsing group.

Exploited software

Vulnerabilities linked to Kinsing

14 CVEs

CVE-2025-55182 React2Shell CVE-2021-44228 Log4Shell CVE-2019-19781 Citrix ADC and Gateway Directory Traversal CVE-2020-11651 Authentication Bypass and RCE in SaltStack Salt CVE-2020-11652 Directory Traversal in SaltStack Salt ClearFuncs CVE-2017-9841 PHPUnit eval-stdin.php Remote Code Execution CVE-2023-4911 Looney Tunables CVE-2020-25213 Unauthenticated Arbitrary File Upload RCE in WordPress File Manager CVE-2023-32315 Openfire Admin Console Authentication Bypass via Path Traversal CVE-2023-46604 Apache ActiveMQ OpenWire Deserialization RCE CVE-2023-42793 Authentication Bypass Leading to RCE in JetBrains TeamCity On-Premises CVE-2023-38035 Ivanti Sentry Administrator Interface Authentication Bypass CVE-2026-33017 Unauthenticated RCE in Langflow build_public_tmp Public Flow Endpoint CVE-2025-24893 Unauthenticated RCE in XWiki SolrSearch

MITRE ATT&CK

Kinsing in ATT&CK

46 distinct techniques

Techniques

46 techniques

T1204.002 Malicious File T1053 Scheduled Task/Job T1105 Ingress Tool Transfer T1543 Create or Modify System Process T1059.004 Unix Shell T1053.003 Cron T1203 Exploitation for Client Execution T1059 Command and Scripting Interpreter T1070.003 Clear Command History T1070 Indicator Removal T1057 Process Discovery T1059.005 Visual Basic T1083 File and Directory Discovery T1071.001 Web Protocols T1496 Resource Hijacking T1562 Impair Defenses T1190 Exploit Public-Facing Application T1078 Valid Accounts T1027 Obfuscated Files or Information T1543.002 Systemd Service T1555 Credentials from Password Stores T1222 File and Directory Permissions Modification T1505.003 Web Shell T1595 Active Scanning T1505 Server Software Component T1499 Endpoint Denial of Service T1210 Exploitation of Remote Services T1570 Lateral Tool Transfer T1068 Exploitation for Privilege Escalation T1136 Create Account T1046 Network Service Discovery T1489 Service Stop T1573.002 Asymmetric Cryptography T1016 System Network Configuration Discovery T1018 Remote System Discovery T1110 Brute Force T1021.004 SSH T1021 Remote Services T1133 External Remote Services T1562.001 Disable or Modify Tools T1552.004 Private Keys T1496.001 Compute Hijacking T1610 Deploy Container T1222.002 Linux and Mac File and Directory Permissions Modification T1552.003 Shell History T1609 Container Administration Command

Reporting

Research mentioning Kinsing

Aug 12

Trendai Security

CVE-2025-55182: React2Shell Analysis, Proof-of-Concept Chaos, and In-the-Wild Exploitation | TrendAI (US)

A critical pre-authentication remote code execution flaw, tracked as CVE-2025-55182 and dubbed React2Shell, was disclosed in React Server Components and related React Flight server-side deserialization logic used by React.js, Next.js, and similar frameworks. The vulnerability affects React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 in the packages react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack, where unsafe deserialization of HTTP request payloads sent to Server Function endpoints can lead to arbitrary code execution in Node.js before authentication. Public reporting said the flaw was fixed in the React repository through pull request #35277, and vendor advisories and CISA tracking indicate the issue drew urgent attention. Security researchers later reported active in-the-wild exploitation beginning almost immediately after disclosure, with mass scanning followed by deployment of Cobalt Strike, Sliver, cryptominers, reverse proxies, a Go backdoor, botnet activity, and a Node.js Secret-Hunter payload aimed at stealing credentials and secrets. Observed campaigns targeted both Linux and Windows systems, and analysis tied the root cause to improper property ownership checks in React's reviveModel function that allowed attacker-controlled serialized payloads to traverse prototype properties. The official patch replaced unsafe ownership checks with Object.prototype.hasOwnProperty.call(...), added explicit handling for __proto__, and prompted guidance to upgrade affected React and Next.js deployments and monitor exposed Server Function endpoints for exploitation attempts.

Jul 31

Sysdig

Threat news: TeamTNT stealing credentials using EC2 Instance Metadata | Sysdig

TeamTNT continued to evolve from a Linux-focused cryptojacking group into a broad cloud threat actor targeting exposed Redis, Docker, Kubernetes, Jupyter, Hadoop, PostgreSQL, Tomcat, Nginx, SSH, and other internet-facing services. Researchers tied the group to worm-like campaigns that rapidly scanned for vulnerable hosts, deployed XMRig miners, dropped Tsunami-based IRC bots including DDoS-capable variants, and used malicious container images on Docker Hub to spread payloads at scale. One TeamTNT-linked Docker Hub account reportedly served images pulled more than 150,000 times, while later campaigns showed the group abusing public registries, compromised accounts, and cloud-native tooling to infect newly exposed systems and report them back to command-and-control infrastructure. Across these operations, TeamTNT consistently paired monetization with aggressive credential theft and stealth. Investigations found the group harvesting AWS, Azure, GCP, Kubernetes, Git, NPM, Grafana, database, and storage secrets; stealing SSH keys and host data; and using tools such as Weave Scope, Peirates, BotB, MimiPenguin, Mimipy, tmate, and Gsocket to expand access and persistence. Analysts also documented detection evasion through log wiping, process hiding, LD_PRELOAD userland rootkits, the Diamorphine kernel rootkit, privileged containers with restart policies, and even disabling runc to lock out rival attackers, underscoring TeamTNT’s shift from opportunistic mining to sustained compromise of cloud and container environments.

Apr 14

Mitre Attack Website

Updated Advisory: Critical RCE vulnerability in React and Next.js (CVE-2025-55182)

Sep 11

Group Ib

Storm clouds on the horizon: Resurgence of TeamTNT? | Group-IB Blog

Nov 28

Fortinet Threat Research

GoTitan Botnet - Ongoing Exploitation on Apache ActiveMQ | FortiGuard Labs

Attackers have actively exploited CVE-2023-46604, a remote code execution flaw in Apache ActiveMQ, to compromise Linux systems and install Kinsing (also known as h2miner). The vulnerability stems from improper validation of throwable class types in OpenWire commands during unmarshalling, allowing malicious code execution on exposed brokers. Trend Micro reported that intrusions led to the delivery of cryptocurrency-mining payloads and rootkit components, causing performance degradation and broader infrastructure impact. Affected software includes multiple Apache ActiveMQ and Legacy OpenWire Module versions prior to the vendor’s patched releases. Apache addressed the issue by adding a validateIsThrowable check in the BaseDataStreamMarshall class, and organizations were urged to upgrade to 5.15.16, 5.16.7, 5.17.6, or 5.18.3 to block further exploitation and malware deployment.