Cryptomining group Kinsing expands operations to Russia, researchers warn
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-9841 | Unauthenticated Remote Code Execution in PHPUnit eval-stdin.php PHPUnit ships a utility script (eval-stdin.php under /vendor/phpunit/phpunit/src/Util/PHP/) that reads HTTP POST data and evaluates it as PHP code with no authentication. The flaw is triggered when a site's /vendor folder is web-accessible and an attacker sends a POST request whose body begins with '<?php ' directly to that URI. Doing so lets the attacker execute arbitrary PHP code on the server under the web server account, giving unauthenticated remote code execution (CWE-94 code injection). Anyone running a PHP application installed with Composer, where PHPUnit is present in the vendor tree and that directory is reachable over HTTP, is affected. The flaw is under active exploitation: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-02-15 and its EPSS probability of exploitation is 100% (top percentile). Do: Apply the CISA KEV required action by updating PHPUnit per vendor instructions, which in practice means updating the CMS/framework or running a Composer update that pulls a patched PHPUnit release. Until patched, block web access to the /vendor directory (e.g., deny /vendor/ or at least /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php in your web server configuration) and verify the endpoint is no longer reachable. Check access logs for POST requests to eval-stdin.php and investigate affected servers for webshells or other signs of compromise. | 9.8 | 100% | KEV |
| masshundreds of thousands of PHP sites/servers potentially exposed (order-of-magnitude estimate; unknown precise count) |
Full article302 words · extracted from therecord.media · click to collapse
Russian cybersecurity researchers said the Kinsing hacker group has launched a large-scale wave of cyberattacks aimed at hijacking Russian computers for cryptocurrency mining. In a report last week, Russia-based cybersecurity firm F6 said the attacks began in April and infected devices with Kinsing and XMRig malware, tools commonly used to mine the cryptocurrency Monero. F6 did not disclose which companies were targeted. Kinsing, also known as H2Miner and Resourceful Wolf, has been active since 2019 and is one of the most prolific groups engaged in so-called cryptojacking. Instead of phishing, the hackers scan company networks for vulnerabilities in widely-used software and exploit them to install malicious code. In the latest campaign, attackers attempted to exploit CVE-2017-9841, a critical flaw in the popular PHP testing framework PHPUnit. The vulnerability, patched in 2017 but still present in outdated systems, allows hackers to remotely execute code and take full control of servers. While most Kinsing attacks have historically been recorded in North America, Western Europe and Asia, F6 said this is the first time it has observed large-scale activity in Russia. It found no evidence of the group targeting companies elsewhere in Eastern Europe. The discovery comes amid a broader rise in cryptomining campaigns in Russia. In June, another group known as Rare Werewolf deployed XMRig on hundreds of Russian computers, including at industrial enterprises and engineering schools, with additional infections reported in Belarus and Kazakhstan. In September, Russian cybersecurity firm F.A.C.C.T. documented a separate campaign delivering XMRig to Russian businesses through malicious email auto-replies. “The case of Kinsing attacks on Russian companies highlights the need to defend against even rare and unusual cyber threats, as criminal groups are not limited by industry or geography and can strike users anywhere in the world,” said Vladislav Kugan, an analyst at the threat intelligence unit of F6.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/cryptomining-group-kinsing-hits-russia