Kinsing [1] [2] [3] [4], a threat actor known for their adaptive attack strategies, is currently exploiting a Linux privilege escalation vulnerability called Looney Tunables in a new experimental campaign targeting cloud environments [1] [2] [3] [4]. This campaign marks the first documented instance of Looney Tunables being actively exploited.
Description
To gain initial access [1] [2], Kinsing is leveraging a critical remote code execution vulnerability in PHPUnit [2]. Once inside the victim’s environment, they search for Looney Tunables and proceed to execute an additional PHP exploit, which acts as a JavaScript web shell [2], granting them backdoor access to the server [2]. The primary objective of this attack is to extract credentials associated with the cloud service provider [1] [2], which will be utilized for future malicious activities. This recent development suggests that Kinsing may be expanding and escalating their operations, posing an increased threat to cloud-native environments [1] [2].
Conclusion
This exploitation of Looney Tunables by Kinsing highlights the need for heightened security measures in cloud environments. It is crucial for organizations to promptly patch vulnerabilities and regularly update their systems to mitigate the risk of such attacks. Additionally, cloud service providers should enhance their monitoring capabilities to detect and respond to potential threats. The implications of this campaign extend beyond the immediate breach, as the stolen credentials can be used for further malicious activities. As Kinsing continues to evolve their tactics, it is imperative for the industry to remain vigilant and proactive in defending against these threats in cloud-native environments.
References
[1] https://thehackernews.com/2023/11/kinsing-actors-exploit-linux-flaw-to.html
[2] https://www.redpacketsecurity.com/kinsing-actors-exploiting-recent-linux-flaw-to-breach-cloud-environments/
[3] https://cyber.vumetric.com/security-news/2023/11/03/kinsing-actors-exploiting-recent-linux-flaw-to-breach-cloud-environments/
[4] https://threatnote.com/infosec-news/from-the-hacker-news-kinsing-actors-exploiting-recent-linux-flaw-to-breach-cloud-environments/
