Procedure examples

Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.

Kinsing has used SSH for lateral movement.

Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.

Kinsing has used ps to list processes.

Kinsing has used Unix shell scripts to execute commands in the victim environment.

Kinsing has communicated with C2 over HTTP.

Kinsing has used valid SSH credentials to access remote hosts.

Kinsing has used the find command to search for specific files.

Kinsing has downloaded additional lateral movement scripts from C2.

Kinsing has attempted to brute force hosts over SSH.

Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.

Kinsing has used chmod to modify permissions on key files for use.

Kinsing has created and run a Bitcoin cryptocurrency miner.

Kinsing has searched bash_history for credentials.

Kinsing has searched for private keys.

Kinsing was executed with an Ubuntu container entry point that runs shell scripts.

Kinsing was run through a deployed Ubuntu container.