Kinsing Malware Exploits Novel Openfire Vulnerability

Aqua Nautilus reports an active campaign exploiting Openfire CVE-2023-32315 to perform path traversal into the setup environment, enabling unauthenticated creation of admin users and upload of malicious plugins (cmd.jsp) that deliver Kinsing malware and cryptominers. The analysis includes attack flow, persistence via cronjobs, Shodan-based exposure enumeration (984 vulnerable instances out of ~5,036 reachable servers), honeypot telemetry observing 1,000+ attacks (91% attributed to Kinsing), and detailed IOCs (file SHA256s and attacker/malware host IPs).