The threat actors behind the
Kinsing cryptojacking operation have been spotted exploiting misconfigured and exposed PostgreSQL servers to obtain initial access to Kubernetes environments.
A second initial access vector technique entails the use of vulnerable images, Sunders Bruskin, security researcher at Microsoft Defender for Cloud,
said in a report last week.
Kinsing has a
storied history of targeting
containerized environments, often leveraging misconfigured open Docker daemon API ports as well as abusing newly disclosed exploits to drop cryptocurrency mining software.
The threat actor, in the past, has also been discovered
employing a rootkit to hide its presence, in addition to terminating and uninstalling competing resource-intensive services and processes.
Now according to Microsoft, misconfigurations in
PostgreSQL servers have been co-opted by the Kinsing actor to gain an initial foothold, with the company observing a "large amount of clusters" infected in this manner.
The misconfiguration relates to a
trust authentication setting, which could be abused to connect to the servers sans any authentication and achieve code execution should the option be set up to accept connections from any IP address.
"In general, allowing access to a broad range of IP addresses is exposing the PostgreSQL container to a potential threat," Bruskin explained.
thehackernews.com
