Security researchers have identified a sophisticated cryptojacking operation, codenamed JINX-0132, targeting exposed DevOps infrastructure including Docker, Gitea, HashiCorp Consul, and Nomad servers. This campaign represents the first documented exploitation of Nomad misconfigurations in the wild.
## Attack Methodology
The threat actors employ a distinctive approach by downloading tools directly from GitHub repositories rather than using their own infrastructure, making attribution more difficult. The campaign has successfully compromised Nomad instances managing hundreds of clients—representing computing resources worth tens of thousands of dollars monthly.
The attackers exploit various entry points:
– **Docker API**: Targeting misconfigured instances to execute malicious code by creating containers that mount host file systems or launch cryptocurrency mining images
– **Gitea**: Exploiting vulnerability CVE-2020-14144 or misconfigurations in this Git repository hosting solution
– **HashiCorp Consul**: Abusing improperly configured servers to register services with malicious health checks that execute mining software
– **Nomad**: Leveraging exposed server APIs to create jobs that download and run XMRig miners
## Global Exposure
Shodan data reveals over 5,300 exposed Consul servers and 400+ Nomad servers worldwide, with concentrations in China, the United States, Germany, Singapore, Finland, the Netherlands, and the United Kingdom.
## Related Open WebUI Campaign
In a separate but related discovery, Sysdig uncovered attackers exploiting misconfigured Open WebUI systems to deploy AI-generated Python scripts that deliver cryptocurrency miners to both Linux and Windows systems.
The malware:
– Downloads and executes T-Rex and XMRig miners
– Establishes persistence via systemd services
– Uses Discord webhooks for command-and-control
– Employs process-hiding techniques for evasion
On Windows systems, the attack additionally deploys Java tools to steal credentials from Discord and cryptocurrency wallet extensions in Chrome.
With over 17,000 internet-accessible Open WebUI instances, this represents a significant attack surface for cryptojacking operations.