Threat actors actively targeted the Apache ActiveMQ vulnerability to get unauthorized access to messaging systems, leading to potential data breaches and system compromise.
Cybersecurity researchers at Sekoia recently identified that the Kinsing Malware actively exploited this Apache ActiveMQ vulnerability to attack the Linux server.
This vulnerability was disclosed on October 27, 2023; it's a severe OpenWire module vulnerability with a critical CVSS3 score of 9.8.
This flaw allows unauthenticated attackers to execute code.
The flaw, rooted in deserialization validation lapses, particularly impacts ExceptionResponseMarshaller.
Attackers can exploit it by creating a weaponized throwable class.
ClassPathXmlApplicationContext can be manipulated through a weaponized XML file, granting code execution.
Patches were released on October 28, 2023, urging updates to the following versions:-.
If updating isn't feasible, then make sure to block the OpenWire access from the Internet, as this will mitigate the risk.
Researchers deployed honeypots globally using ActiveMQ v5.17.5.
Monitored host with Sekoia Linux agent and Suricata IDS. Honeypots were active since 9 Nov 2023, and the first Kinsing intrusion was tracked on 11 Nov. Daily 2-3 Kinsing intrusions were recorded since 12 Nov, and the attacks were executed from the following two IP addresses:-.
Here below, we have mentioned all the actions that are performed by the Kinsing malware:-.
Here below, we have mentioned all the characteristics of the Kinsing malware:-.
File: ELF 64-bit LSB executable, x86-64, version 1 , statically linked, stripped.
The malware code contains over 60 functions, and below we have mentioned a few of them:-.
The cryptominer that is deployed is XMRig, and the UPX-packed with config details.
Decompressed, it reveals a Monero wallet and nanopool.org URL. However, this wallet has been inactive since Nov 2019.
The CTI Reports link this wallet to Kinsing, but it's.
The numerous breaches highlight how important it is to apply security updates quickly and maintain strict control over weak points, particularly in dockerized services.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 12 Dec 2023 08:25:23 +0000