KinsingThreat actor
- money libra
This group started operating during the first quarter of 2022. They published samples of alleged stolen data from companies on their site on Tor. It is unclear if they conducted the attacks themselves, or if they bought leaked databases from third parties.From MISP Galaxy
Last reported 4 months ago, by Trend Micro Research1 report
ATT&CK techniques
6 of 41 · each with the sentence it comes from- T1014Rootkit
“That is a defensive move specifically aimed at rival rootkits.”
- T1016System Network Configuration Discovery
“T1016 System Network Configuration Discovery”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1021.004SSH
“T1021.004 Remote Services: SSH”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
- T1036Masquerading
“T1036.005 Masquerading: Match Legitimate Name or Location”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
From Langflow to Monero: Inside CVE-2026-33017 Cryptominer“Commodity-focused threat actors such as Kinsing and TeamTNT reuse wallets across dozens of samples.”
Indicators in its reports
named in the reports above- 83.142.209[.]214in 1 report
- 94.156.64[.]241in 1 report
- 46096a72d84db5f1dafd944fcf6571c8in 1 report
Copy these 3 indicators · defanged
Thanks — we review every report.