Loading threat actor…
Kinsing is a financially motivated cloud- and Linux-focused threat actor best known for large-scale cryptojacking operations. The group has been active since at least 2020 and is also tracked as H2Miner. Kinsing primarily targets internet-exposed and misconfigured services in cloud and containerized environments, including Docker APIs, Kubernetes-related infrastructure, Redis, Jenkins, web applications, and vulnerable middleware such as Apache ActiveMQ. The actor has repeatedly exploited known vulnerabilities at high speed, including Log4Shell, CVE-2023-46604 in Apache ActiveMQ, CVE-2017-9841 in PHPUnit, and has been observed attempting local privilege escalation via CVE-2023-4911 in glibc.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
The Kinsing threat actor has a history of exploiting the PHPUnit vulnerability (CVE-2017-9841)... The initial access was conducted by exploitation of the PHPUnit vulnerability (CVE-2017-9841).
we have uncovered the threat actor’s manual efforts to manipulate the Looney Tunables vulnerability (CVE-2023-4911)... These tests were aimed at probing the Looney Tunables vulnerabilities (CVE-2023-4911)... Looney Tunables is a high-severity vulnerability resides in the GNU C Library (glibc), specifically targeting its dynamic loader, ld.so.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Referenced as an example threat actor associated with deploying known cryptominer binaries on Linux systems.
Referenced as a rival Linux cryptomining threat actor whose miner artifacts and process names are explicitly targeted for termination by the lambsys operator.
Abuses native Linux utilities, cloud tooling, cron jobs, and SSH persistence in compromised Linux/cloud environments while deploying cryptominers.
Referenced only as another threat actor observed using XMRig.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.