Kinsing

Also known as Money Libra

This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases from third parties.

Recent activity

No posts or advisories have named this actor recently.

References

• https://www.trendmicro.com/en_us/research/20/k/analysis-of-kinsing-malwares-use-of-rootkit.html
• https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability
• https://sysdig.com/blog/zoom-into-kinsing-kdevtmpfsi/
• https://unit42.paloaltonetworks.com/atoms/moneylibra/

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.