Cybercriminals Leverage DevOps Web Server Flaws to Launch Malware Attacks

A significant cryptojacking campaign, orchestrated by a threat actor identified as JINX-0132, has been observed targeting vulnerable and misconfigured DevOps web server platforms.

The campaign, discovered by Wiz Threat Research Report, demonstrates systematic exploitation of widespread security lapses in publicly accessible applications such as HashiCorp Nomad, HashiCorp Consul, Docker Engine API, and Gitea.

The attacks leverage known vulnerabilities and default configurations to deploy cryptocurrency mining malware, with a sophisticated preference for “living-off-open-source” tactics rather than traditional, easily attributed malware infrastructure.

Misconfiguration Abuse in DevOps Infrastructure

JINX-0132’s attack methodology focuses on the exploitation of misconfigurations and weak default settings in core DevOps technologies.

Notably, the research marks the first documented exploitation of publicly accessible Nomad instances, with the attacker leveraging the platform’s default permissive job API to achieve remote code execution (RCE) across entire clusters.

By submitting custom Nomad jobs often with random or offensive naming conventions the threat actor automates the retrieval and execution of the legitimate XMRig Monero miner directly from GitHub, bypassing the need for custom payload hosts.

Similar abuse is observed in HashiCorp Consul, where attackers utilize the service registration and health check features to execute mining software on registered agents.

In Docker environments, exposed REST APIs (tcp://0.0.0.0:2375/2376) are exploited to spawn containers mounting host filesystems, granting privileged access and facilitating miner deployment.

The Gitea platform is also targeted through several attack vectors, including exploitation of default settings (such as insecure git hook permissions), vulnerabilities in legacy versions, and unsecured installation processes.

Scope and Impact

The scope of this threat is significant. According to Wiz’s telemetry, 25% of cloud environments deploy at least one of these DevOps tools, with Consul present in over 20% of cases.

Alarmingly, around 5% of deployments are directly exposed to the internet, and of these, 30% are misconfigured leaving thousands of systems worldwide vulnerable to exploitation.

Incidents involving compromised Nomad servers show attackers hijacking clusters with vast CPU and memory resources, translating into thousands of dollars in compute costs repurposed for illicit cryptocurrency mining.

JINX-0132 is distinguished by an operational discipline that avoids leaving unique attack signatures.

Instead of custom exploit servers or binaries, the actor relies on public open-source repositories and official binary releases.

The only persistent indicator is the Monero wallet address used by the mining software, which is trivial for the attacker to rotate.

To mitigate risk, organizations are strongly advised to adhere to vendor best practices:

• Nomad and Consul: Strictly enforce ACLs, limit API exposure to trusted networks, and disable script checks where unnecessary.
• Gitea: Regularly update instances, restrict user and hook permissions, and ensure installation scripts are locked down.
• Docker API: Never expose the Docker API externally without stringent access controls and TLS authentication.

This campaign exemplifies the critical risks posed by misconfigured DevOps infrastructure in cloud-native environments.

With attackers moving rapidly to exploit even minor oversights, proactive configuration management and continuous monitoring are imperative for organizations relying on DevOps tooling.

Indicators of Compromise (IOC)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates