Kinsing Hackers Exploit 'Looney Tunables' Linux Bug to Steal Cloud Credentials

Hackers behind the Kinsing malware are targeting vulnerable cloud environments by exploiting the Linux security issue known as "Looney Tunables" (CVE-2023-4911), which allows attackers to gain root privileges. The Kinsing malware, known for deploying cryptomining software, has been observed breaching cloud-based systems and applications such as Kubernetes, Docker APIs, Redis, and Jenkins. The attack involves exploiting a vulnerability in the PHP testing framework 'PHPUnit' to gain code execution, followed by leveraging the Looney Tunables issue for privilege escalation. The attackers are also interested in obtaining cloud service provider credentials, indicating a shift towards more sophisticated activities.