Kinsing Cryptominer Exploits Apache ActiveMQ RCE (CVE-2023-46604), Adds Sharpire Backdoor for Multi-Stage Intrusion

According to AhnLab’s analysts, the Kinsing threat actor — also known as H2Miner — continues to actively exploit CVE-2023-46604 in Apache ActiveMQ to distribute cryptocurrency miners and remote-access tools across Linux and Windows systems. The campaign has expanded beyond cryptomining to include multiple post-exploitation frameworks such as Cobalt Strike, Meterpreter and PowerShell Empire, alongside a new .NET-based backdoor named Sharpire.

Kinsing, first identified by Alibaba Cloud Security in 2020, targets misconfigured or unpatched servers to deploy XMRig miners and has now integrated Sharpire to support remote control, reconnaissance and lateral movement. In recent South Korea infections, the operation uses a chain of downloader malware triggered by a malicious XML configuration file, with msiexec.exe downloading MSI-based malware to establish persistence and connect back to the attacker’s infrastructure.

Sharpire can execute PowerShell commands, manage files, query network configurations and reboot or shut down compromised systems, with more than a dozen command functions reported. This combination of Cobalt Strike, Meterpreter and Sharpire signals a clear escalation toward multi-stage intrusion and ransomware-leaning capabilities.