Skip to content
skopnix
Adversaries · Dossier
← Adversaries

File · Kinsing · Unknown · misp-galaxy · refreshed 2026-10-06

Kinsing

  • Money Libra

sigil · no ATT&CK coverage stated

What changed

ledger · newest first
  1. 2026-10-18todaynew CVE1 new CVE: CVE-2023-32315

Analyst brief

misp-galaxy

This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases from third parties.

CVEs Kinsing is cited as exploiting

none on KEV
  1. CVE-2023-323152026-10-17
    1. “Update (8/27/23) – Aqua Nautilus discovered a new campaign that exploits the Openfire vulnerability (CVE-2023-32315 to deploy Kinsing malware and a cryptominer.”

      cited as exploiting · source: blog.aquasec.com ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Detections

7 rules · Sigma · QRadar · Cortex

  1. Actor indicator sweep

    Kinsing file hash indicators

    Kinsing

    T1204.002conf 77SIGAQLXQL

  2. Indicator

    Known-malicious file hash observed

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  3. Indicator

    Malicious Hashes

    APT41 · blackbyte · Caliente Bandits · CeranaKeeper · DragonSpark · FIN7 · 19 more

    T1204.002conf 72AQL

  4. Indicator

    Execution of known malicious file c38c21120d8c1768…

    Kinsing

    T1204.002conf 77SIGXQL

Generated by skopnix from this finding, each with false-positive notes. Open the list →

Take it with you

keyless · no signup

References

4 sources
  1. 1.trendmicro.com/en_us/research/20/k/analysis-of-kinsing-malwares-use-o…
  2. 2.blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
  3. 3.sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi
  4. 4.unit42.paloaltonetworks.com/atoms/moneylibra

Track Kinsing on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.