Kinsing Exploits ActiveMQ RCE, With Sharpire Backdoor Found on Payload Server

AhnLab Security Intelligence Center identified Kinsing attacks exploiting Apache ActiveMQ remote code execution vulnerability CVE-2023-46604 against vulnerable servers in South Korea, targeting both Windows and Linux. Attackers used malicious XML configuration files to execute commands and install downloader malware. Their download server also hosted Linux scripts associated with XMRig cryptocurrency mining and Sharpire, a .NET backdoor supporting PowerShell Empire, indicating potential remote-control capabilities beyond cryptomining.

ASEC could not retrieve the downloaders’ subsequent payloads, leaving deployment of Cobalt Strike or Meterpreter unconfirmed; the presence of Sharpire on the server alone does not establish its installation on victims. Information theft and ransomware were potential consequences, not observed outcomes. Separate reporting on Kinsing attacks against container environments and h2Miner outbreaks exploiting Redis RCE highlights the broader threat to exposed infrastructure. Defenders should prioritize patching vulnerable ActiveMQ instances, restrict access to broker services, and investigate unexpected command execution, downloads, and mining activity.