Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking

Kinsing is a persistent cryptojacking malware family and actor active since at least 2019 that continuously incorporates newly disclosed vulnerabilities and misconfiguration exploitation (e.g., Apache products, Log4j, Docker, Redis, PostgreSQL, WebLogic, SaltStack) to compromise Linux and Windows hosts, disable security controls, deploy rootkits and miners, and operate a global crypto-mining botnet; the report details its three-tier infrastructure (scanners/exploit servers, download servers, C2), categorized scripts and binaries, and observed country-level hosting for payloads and command servers.