ActiveMQ CVE-2023-46604 exploited by Kinsing intrusion set

While the vulnerability has also been exploited to deploy some reverse shell, Kinsing remains the only major intrusion set based on our observation.
Within 24 hours of going online, our honeypots were compromised by Kinsing.
The first Kinsing intrusion was recorded two days later, on 11 November.
From 12 November 2023, between two and three Kinsing intrusions are recorded daily on each honeypots.
An xml payload is hosted on a web server controlled by Kinsing.
Overview of the Kinsing exploitation OpenWire traffic.
All Kinsing compromises of our honeypots were carried out by 2 IP addresses.
One of these was already used by Kinsing to exploit the Metabase vulnerability.
The URLs are stable over time, having been used by Kinsing in previous compromises dating back several months.
One of them, named getActiveC2Url, allows us to retrieve Kinsing C2s and connect to them.
Kinsing C2 order to download cryptominer - decryption with CyberChef.
Kinsing contains a large number of other functions commonly found in RATs.
For now, Kinsing IS only uses its malware to deploy cryptominer, but it offers a much wider range of possibilities.
Based on the monitoring of this mining pool, Kinsing wallet grows by on average 0.11 Monero per day.
Since 26 September 26 2022, the date of the first payment on this service, Kinsing has obtained in total 21.2286 Monero for its mining activity.
Compared with the number of machines potentially vulnerable to CVE 2023 46604 and other vulnerabilities actively exploited by Kinsing, this number seems low.
We found that Kinsing attacked almost simultaneously all our honeypots at fairly fixed times, around 6a.m, 12pm and 00pm. This suggests that Kinsing operates during these hours.
In total, in just over a year, Kinsing has generated 25 Monero on this Wallet, equivalent to around 3,750 euros at the November 2023 exchange rate.
Our honeypots went into production around ten days after the release of the proof of concept code, and were very quickly compromised by Kinsing.
Kinsing has a consistent and stable infrastructure which results in high hosting costs.


This Cyber News was published on blog.sekoia.io. Publication date: Mon, 11 Dec 2023 08:43:05 +0000


Cyber News related to ActiveMQ CVE-2023-46604 exploited by Kinsing intrusion set

ActiveMQ CVE-2023-46604 exploited by Kinsing intrusion set - While the vulnerability has also been exploited to deploy some reverse shell, Kinsing remains the only major intrusion set based on our observation. Within 24 hours of going online, our honeypots were compromised by Kinsing. The first Kinsing ...
1 year ago Blog.sekoia.io
The Threat That Can't Be Ignored: CVE-2023-46604 in Apache ActiveMQ - There is another vulnerability that demands immediate attention, despite not receiving the level of recognition it truly deserves in the media. Apache ActiveMQ vulnerability, known as CVE-2023-46604, is a Remote Code Execution flaw rated at a ...
8 months ago Cybersecurity-insiders.com
Kinsing malware exploits Apache ActiveMQ RCE to plant rootkits - The Kinsing malware operator is actively exploiting the CVE-2023-46604 critical vulnerability in the Apache ActiveMQ open-source message broker to compromise Linux systems. The flaw allows remote code execution and was fixed in late October. Apache's ...
1 year ago Bleepingcomputer.com
TellYouThePass ransomware joins Apache ActiveMQ RCE attacks - Internet-exposed Apache ActiveMQ servers are also targeted in TellYouThePass ransomware attacks targeting a critical remote code execution vulnerability previously exploited as a zero-day. The flaw, tracked as CVE-2023-46604, is a maximum severity ...
1 year ago Bleepingcomputer.com
Apache ActiveMQ Vulnerability Exploited to Attack Linux Servers - Threat actors actively targeted the Apache ActiveMQ vulnerability to get unauthorized access to messaging systems, leading to potential data breaches and system compromise. Cybersecurity researchers at Sekoia recently identified that the Kinsing ...
1 year ago Cybersecuritynews.com
Hackers exploit Looney Tunables Linux bug, steal cloud creds - The operators of the Kinsing malware are targeting cloud environments with systems vulnerable to "Looney Tunables," a Linux security issue identified as CVE-2023-4911 that allows a local attacker to gain root privileges on the system. Looney Tunables ...
1 year ago Bleepingcomputer.com
CISA orders federal agencies to patch Looney Tunables Linux bug - Today, CISA ordered U.S. federal agencies to secure their systems against an actively exploited vulnerability that lets attackers gain root privileges on many major Linux distributions. Dubbed 'Looney Tunables' by Qualys' Threat Research Unit and ...
1 year ago Bleepingcomputer.com
3,000 Apache ActiveMQ servers vulnerable to RCE attacks exposed online - Over three thousand internet-exposed Apache ActiveMQ servers are vulnerable to a recently disclosed critical remote code execution vulnerability. Apache ActiveMQ is a scalable open-source message broker that fosters communication between clients and ...
1 year ago Bleepingcomputer.com
HelloKitty Ransomware Group Exploiting Apache ActiveMQ Vulnerability - Cybersecurity researchers are warning of suspected exploitation of a recently disclosed critical security flaw in the Apache ActiveMQ open-source message broker service that could result in remote code execution. "In both instances, the adversary ...
1 year ago Thehackernews.com
Godzilla Web Shell Attacks Stomp on Critical Apache ActiveMQ Flaw - Threat actors have unleashed a fresh wave of cyberattacks targeting a critical remote code-execution vulnerability in Apache ActiveMQ, for which the Apache Software Foundation issued a patch back in October. In many of the attacks, the adversary has ...
11 months ago Darkreading.com
Hackers Actively Exploiting ActiveMQ Vulnerability Install Malware - Attackers have been exploiting the Apache ActiveMQ Vulnerability to steal data and install malware constantly. Using the Apache ActiveMQ remote code execution vulnerability, the Andariel threat group was found to be installing malware last month. ...
1 year ago Gbhackers.com
Best of 2023: Diamond Model of Intrusion Analysis: A Quick Guide - Any intrusion into a network calls for a thorough analysis to give security teams cyber intelligence about different threats and to help thwart similar future attacks. Effective incident analysis has long been held back by uncertainty and high false ...
11 months ago Securityboulevard.com
Delta Electronics InfraSuite Device Master - RISK EVALUATION. Successful exploitation of this vulnerability could allow remote code execution. Delta Electronics InfraSuite Device Master contains a deserialization of untrusted data vulnerability because it runs a version of Apache ActiveMQ which ...
7 months ago Cisa.gov
GoTitan Botnet and PrCtrl RAT Exploit Apache Vulnerability - Threat actors have been observed exploiting a critical vulnerability, CVE-2023-46604, in Apache systems. Over the past few weeks, Fortiguard Labs identified multiple threat actors leveraging this vulnerability to unleash several malware strains. ...
1 year ago Infosecurity-magazine.com
Check Point released hotfix for actively exploited VPN zero-day - MUST READ. Check Point released hotfix for actively exploited VPN zero-day. Microsoft Patch Tuesday security updates for May 2024 fixes 2 actively exploited zero-days. Critical Fortinet's FortiClient EMS flaw actively exploited in the wild. Apple ...
7 months ago Securityaffairs.com
New MOVEit Transfer critical bug is actively exploited - MUST READ. New MOVEit Transfer critical bug is actively exploited. CISA adds Microsoft SharePoint bug disclosed at Pwn2Own to its Known Exploited Vulnerabilities catalog. Critical Fortinet's FortiClient EMS flaw actively exploited in the wild. PoC ...
6 months ago Securityaffairs.com
CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
7 months ago Securityaffairs.com
GoTitan Botnet Actively Exploiting Apache ActiveMQ Vulnerability - Attackers are exploiting the recently discovered critical security vulnerability tracked as affecting Apache ActiveMQ to disseminate the Golang-based botnet GoTitan and the. NET application "PrCtrl Rat," which has the ability to be remotely ...
1 year ago Cybersecuritynews.com
CVE-2020-11111 - FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms). ...
3 years ago
BreachForums resurrected after FBI seizure - Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 Windows flaw. Microsoft fixed two zero-day bugs exploited in malware attacks. HTTP/2 CONTINUATION Flood technique can be exploited in DoS attacks. BianLian group ...
7 months ago Securityaffairs.com
Monti gang claims the hack of the Wayne Memorial Hospital in Pennsylvania - CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. Microsoft fixed two zero-day bugs exploited in malware attacks. HTTP/2 CONTINUATION Flood technique can be exploited in DoS attacks. BianLian group exploits JetBrains ...
6 months ago Securityaffairs.com
Juniper Networks fixed a critical authentication bypass flaw in some of its routers - MUST READ. Threat actors actively exploit D-Link DIR-859 router flaw CVE-2024-0769. CISA adds Oracle WebLogic Server flaw to its Known Exploited Vulnerabilities catalog. Russia-linked APT28 used post-compromise tool GooseEgg to exploit CVE-2022-38028 ...
6 months ago Securityaffairs.com
newsletter Round 473 by Pierluigi Paganini - Microsoft Patch Tuesday security updates for May 2024 fixes 2 actively exploited zero-days. Microsoft fixed two zero-day bugs exploited in malware attacks. HTTP/2 CONTINUATION Flood technique can be exploited in DoS attacks. BianLian group exploits ...
7 months ago Securityaffairs.com
Sav-Rx data breach impacted over 2.8 million individuals - Microsoft Patch Tuesday security updates for May 2024 fixes 2 actively exploited zero-days. Nation-state actors exploited two zero-days in ASA and FTD firewalls to breach government networks. Microsoft fixed two zero-day bugs exploited in malware ...
7 months ago Securityaffairs.com
Healthcare firm WebTPA data breach impacted 2.5M individuals - Microsoft Patch Tuesday security updates for May 2024 fixes 2 actively exploited zero-days. CISA adds GitLab flaw to its Known Exploited Vulnerabilities catalog. Nation-state actors exploited two zero-days in ASA and FTD firewalls to breach ...
7 months ago Securityaffairs.com

Latest Cyber News


Cyber Trends (last 7 days)


Trending Cyber News (last 7 days)