According to The Register, security company Wiz has discovered that a hacker group with the code name JINX-0132 is using DevOps tool configuration vulnerabilities on a large scale to carry out cryptocurrency mining attacks. The attack mainly targets tools such as HashiCorp Nomad/Consult, Docker API, and Gitea, with approximately 25% of cloud environments being at risk. The attack methods include deploying XMrig mining software using Nomad's default configuration, executing malicious scripts through Consul's unauthorized API, and creating mining containers by controlling exposed Docker APIs. Wiz data shows that 5% of DevOps tools are directly exposed to the public network, with 30% having configuration defects. The security team recommends that users update software in a timely manner, disable non essential features, and restrict API access permissions.
This attack once again highlights the importance of cloud environment configuration management. HashiCorp's official documentation has previously warned of related risks, but a large number of users have not yet enabled basic security features. Experts emphasize that simple configuration adjustments can block most automated attacks.
