US EditionIllicit Crypto-Miners Pouncing on Insecure DevOps Tools
- Security researchers at Wiz detected a campaign by attacker JINX-0132 exploiting exposed DevOps tools for illicit cryptocurrency mining in 2025.
- The campaign exploits misconfigurations and vulnerabilities in HashiCorp Nomad, Consul, Gitea, and Docker APIs, often due to default or weak security settings.
- JINX-0132 abuses public APIs to create multiple seemingly random services that download and run the open-source XMRig miner fetched directly from GitHub to avoid detection.
- Wiz reports that 25% of cloud environments run these tools, 5% expose them publicly, and 30% of exposed deployments are misconfigured, putting up to a quarter of users at risk.
- The campaign demonstrates that unsecured DevOps APIs allow remote code execution across connected nodes, highlighting the urgent need to patch, restrict access, and avoid exposing APIs publicly.
11 Articles
11 Articles
Global Security Mag Online
Global Security Mag OnlineSysdig's Threat Research (TRT) team recently discovered that a group of cybercriminals were exploiting a configuration flaw on Open WebUI - a very popular open source web interface (95,000 stars on GitHub), allowing to interact and improve AI models such as LLM – in order to infiltrate a client's server and deploy crypto-mining software. How? By taking advantage of admin access left open and without authentication on the Internet by mistake, cyb…
Cryptojacking campaign relies on DevOps tools
A cryptojacking campaign is targeting exposed DevOps servers like Docker and Gitea to secretly mine cryptocurrency. Wiz researchers uncovered a cryptojacking campaign, tracked as JINX-0132, targeting exposed DevOps applications like Nomad, Consul, Docker, Gitea to secretly mine cryptocurrency. Threat actors behind the… Read more → The post Cryptojacking campaign relies on DevOps tools appeared first on IT Security News.
CSO Online
InfoWorldThe high cost of misconfigured DevOps: Global cryptojacking hits enterprises
A massive ongoing cryptojacking operation is actively exploiting misconfigured DevOps tools, including Nomad, Consul, Docker, and Gitea, to hijack computing power for cryptocurrency mining, Wiz Threat Research revealed. Dubbed Jinx-0132 by researchers, the campaign has compromised systems globally with attackers deploying XMRig-based miners within minutes of breaching exposed APIs and weak configurations. This marks the first known case of attac…
Coverage Details
Bias Distribution
- 100% of the sources are Center
To view factuality data please Upgrade to Premium
Ownership
To view ownership data please Upgrade to Vantage
