Cryptocurrency Mining Campaign Targets Vulnerable Apache NiFi Instances

Diving into details

• The initial entry point is utilized to deploy a shell script that eradicates the "/var/log/syslog" file, deactivates the firewall, and terminates rival crypto-mining tools. 
• Following this, the script proceeds to retrieve and initiate the Kinsing malware from a remote server. Additionally, the same malicious actor made a few attempts to execute an alternative script, spre.sh, with the aim of obtaining SSH keys from the compromised host to gain access to other systems within the victim's organization.
• An identifiable sign of the ongoing campaign involves the utilization of the IP address 109.207.200[.]43 to carry out the actual attack and scanning operations on port 8080 and port 8443/TCP.

Why Kinsing?

• In January, Kinsing operators were found using vulnerable software images and misconfigurations in PostgreSQL to gain initial access to Kubernetes environments.
• The attackers scanned for open default WebLogic port 7001 to execute a shell command and run the malware.
• Vulnerable container images allow remote code execution, enabling hackers to deploy malware, ultimately leading to cryptojacking. 

The bottom line