Kinsing malware exploits Apache ActiveMQ RCE to plant rootkit

Kinsing malware distributors are actively exploiting the critical vulnerability CVE-2023-46604 in the Apache ActiveMQ open-source message broker to compromise Linux systems.

The flaw allows remote code execution and was patched in late October. Apache's disclosure explained that the issue allows the execution of arbitrary shell commands by leveraging serialized class types in the OpenWire protocol.

Following the release of the patch, thousands of servers remained vulnerable, and ransomware groups such as HelloKitty and TellYouThePass began to exploit this opportunity.

▌Kinsing Targets ActiveMQ

Recent research shows that Kinsing has been added to the list of attackers exploiting CVE-2023-46604, with their goal being to deploy cryptocurrency mining software and malware on vulnerable servers.

Targeting Linux systems, Kinsing malware is notorious for exploiting known flaws often overlooked by system administrators. Previously, they relied on Log4Shell and Atlassian Confluence RCE vulnerabilities for their attacks.

Currently, there are existing public exploits leveraging the ProcessBuilder method to execute commands on affected systems.

In the context of Kinsing, CVE-2023-46604 is exploited to download and execute the Kinsing cryptocurrency miner and malware on vulnerable systems.

The malware uses the "ProcessBuilder" method to execute malicious bash scripts and downloads additional payloads onto compromised devices from newly created system-level processes.

Downloading binaries and payloads

The advantage of this approach is that it allows the malware to execute complex commands and scripts with a high degree of control and flexibility, while also evading detection.

ProcessBuilder exploit used in Kinsing attacks

Before launching the crypto miner, Kinsing checks the machine for competing Monero miners by terminating any related processes, crontabs, and active network connections.

Scanning for competing miners

Afterward, it establishes persistence via a cronjob, retrieves the latest version of the infection script (bootstrap), and adds a rootkit to "/etc/ld.so.preload".

Malicious cronjob added to the host

The /etc directory on Linux systems typically hosts system configuration files, executables used to boot the system, and some log files, meaning libraries in this location are loaded before program processes start.

In this scenario, adding the rootkit ensures its code is executed along with every process started on the system while remaining relatively hidden and difficult to remove.

With the number of attackers exploiting CVE-2023-46604 rising, organizations with numerous business units remain at risk if they do not patch the vulnerability or check for signs of compromise.

To mitigate threats and reduce risk, system administrators are advised to upgrade Apache ActiveMQ to versions 5.15.16, 5.16.7, 5.17.6, or 5.18.3 to resolve the security issues.

Meanwhile, the Securityworks Validation Platform already includes this vulnerability. You can search for the keywords "CVE-2023-46604" or "Kinsing" in the platform to obtain relevant attack simulation verification actions. This allows you to verify whether your security defense system can effectively counter ransomware and cryptomining attack techniques, ensuring harmlessness during verification in an industry-exclusive manner.

Securityworks also provides enterprises with a backdoor mining defense assessment service, covering over 200 attack techniques. It quickly and on a large scale simulates intrusions prior to the deployment of mining software, helping to verify whether your defense system can respond correctly to these attack methods, and delivers a complete assessment report for improvement reference, along with systematic causes and mitigation recommendations.

Attachment: Official Security Advisory

https://activemq.apache.org/news/cve-2023-46604

https://activemq.apache.org/security-advisories.data/CVE-2023-46604-announcement.txt