Kinsing Malware Attacks Targeting Container Environment

Aqua Security describes an active, persistent campaign exploiting misconfigured Docker Daemon API ports to spawn Ubuntu containers that run a downloaded shell script (d.sh/spre.sh) which installs the Kinsing Go-based malware and a kdevtmpfsi cryptominer. The malware establishes C2 communications, disables defenses, achieves persistence via cron, kills competing malware, and spreads laterally across containers and hosts using harvested SSH credentials and scripted SSH commands; the report includes IPs, URLs, MD5s and mitigation recommendations.