Hackers use public DevOps tools for cryptocurrency mining attacks

Security firm Wiz has discovered that a hacker group codenamed JINX-0132 is using a DevOps tool configuration vulnerability on a large scale to conduct cryptocurrency mining attacks. The attack mainly targets tools such as HashiCorp Nomad/Consul, Docker API and Gitea, and about 25% of cloud environments are at risk. The attack methods include: deploying XMRig mining software with Nomad default configuration, executing malicious scripts through Consul's unauthorized API, and controlling the exposed Docker API to create mining containers.