According to PANews, security firm Wiz has identified a hacker group, codenamed JINX-0132, that is exploiting configuration vulnerabilities in DevOps tools for large-scale cryptocurrency mining attacks. The tools targeted include HashiCorp Nomad/Consul, Docker API, and Gitea, with approximately 25% of cloud environments at risk.
The attack methods involve deploying XMRig mining software using Nomad's default configuration, executing malicious scripts through unauthorized Consul API access, and controlling exposed Docker APIs to create mining containers. Wiz's data indicates that 5% of DevOps tools are directly exposed to the public internet, with 30% having configuration flaws.
Security teams recommend users promptly update software, disable unnecessary features, and restrict API access permissions to mitigate risks. This attack highlights the importance of cloud environment configuration management. Despite warnings from HashiCorp's official documentation about related risks, many users have not enabled basic security features. Experts emphasize that simple configuration adjustments can prevent most automated attacks.
