A new cryptojacking campaign, named JINX-0132, has emerged, targeting misconfigured DevOps servers to mine cryptocurrencies, especially leveraging tools such as Docker, Gitea, HashiCorp Consul, and Nomad. Exploiting known vulnerabilities and misconfigurations, the attackers employ open-source tools retrieved from GitHub, adeptly evading attribution by utilizing legitimate platforms.
In a concerning revelation, this campaign marks the first documented case of exploiting Nomad misconfigurations in the wild. Instances compromised by JINX-0132 have been found managing resources worth tens of thousands of dollars each month, significantly impacting enterprise computing costs worldwide.
The JINX-0132 group primarily targets cloud infrastructure employing insecure default settings or being publicly exposed. Research indicates that as many as 25% of cloud environments run these vulnerable tools, with 5% exposing them directly to the internet, of which 30% are misconfigured. The attackers capitalize on these weaknesses, using default insecure configurations, disabled security features, and publicly accessible APIs to gain remote code execution capabilities and install XMRig mining software.
Organizations can defend against these cryptojacking tactics by enforcing robust access controls, enabling security features, keeping tools updated, and adhering strictly to security best practices for DevOps infrastructure. By securing APIs, demanding authentication, and examining configurations, enterprises can fortify their defenses against such exploitative attacks. This proactive stance will mitigate the high costs associated with cryptojacking and protect computing resources from unauthorized mining operations.

Collections

A new cryptojacking campaign called JINX-0132 exploits misconfigured DevOps tools like Docker, Gitea, HashiCorp Consul, and Nomad to mine cryptocurrencies. This marks the first documented case of exploiting Nomad misconfigurations in the wild. The attackers target cloud infrastructure with insecure default settings, affecting 25% of cloud environments with 5% exposed to the internet. Organizations can defend by enforcing access controls, enabling security features, keeping tools updated, and following DevOps security best practices.

JINX-0132 Cryptojacking Campaign Targets Misconfigured DevOps Servers