JINX-0132 Exploits Exposed DevOps Tools to Deploy XMRig Cryptominers
Summary
Wiz researchers describe JINX-0132 exploiting exposed or misconfigured Nomad, Consul, Docker API, and Gitea instances to run XMRig miners, and outline exposure findings and defenses.
Key points
- The campaign abuses exposed Nomad and Consul control planes, unauthenticated Docker APIs, and vulnerable or misconfigured Gitea instances to gain code execution.
- On Nomad and Consul, attackers create jobs or service health checks that download and run standard XMRig releases from GitHub.
- The miners connect to a public Monero pool using an attacker-controlled wallet; the article notes the actor avoids custom payload infrastructure and relies largely on off-the-shelf tools.
- Wiz says 5% of environments using the referenced DevOps technologies expose them directly to the internet, and 30% of those exposed deployments are misconfigured.
- Recommended defenses include enabling Nomad and Consul access controls, disabling Consul script checks, restricting APIs to trusted interfaces, updating Gitea, and keeping the Docker API off the public internet.
Article Details
- Attack Vectors
- JINX-0132 exploited publicly exposed, insufficiently secured Nomad APIs to submit jobs that downloaded and ran XMRig on connected nodes.
- The campaign used Consul service registration and health checks containing shell commands to download and execute XMRig.
- Publicly exposed Gitea instances could provide an initial foothold through vulnerable or misconfigured Git hooks, the unauthenticated RCE in version 1.4.0, or an unlocked installer; the article says the specific method used in each case is uncertain.
- An exposed Docker Engine API can enable remote code execution, including by launching a container that mounts the host filesystem; the article describes this as a known attack vector but does not specifically attribute its use in this campaign.
- Defensive Notes
- Configure Nomad ACLs and other security features to prevent unauthorized access to job submission.
- Keep Gitea updated, disable Git hooks unless necessary, and ensure the installation wizard is locked.
- For Consul, disable script checks and restrict the HTTP API to localhost where possible; configure ACLs and other security features.
- Do not expose the Docker API to the Internet or unauthorized users.
- Use the described Wiz scanners and Threat Center query/advisory to identify exposed or misconfigured instances and detect related mining activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | ea7c97294f415dc8713ac8c280b3123da62f6e56 | Hash identified in the article as the XMRig 6.22.2 binary observed in the cryptojacking activity; the release is official and the hash is not unique to JINX-0132. |
MITRE ATT&CK
T1059.004 · Unix ShellNomad jobs and Consul health checks ran shell commands to download and execute the miner.T1105 · Ingress Tool TransferThe commands downloaded XMRig directly from its public GitHub release repository.T1496 · Resource HijackingXMRig used CPU resources on compromised servers to mine Monero for the attacker's wallet.T1610 · Deploy ContainerThe article describes abusing the exposed Docker API to launch malicious containers, including a crypto-miner image.
CVE
CVE-2020-14144to post-authentication remote code execution (RCE) due to an insecure default vulnerability (CVE-2020-14144), but there are multiple prerequisites for exploitation: in versions 1.1.0 through 1.12.5, the flagCVE-2020-15867script that runs with Gitea’s OS privileges. Note that this vulnerability also affects Gogs (CVE-2020-15867), from which Gitea was forked.
Threat Actors
Malware
Vendors
HashiCorpHashiCorp Nomad - a simple scheduler and orchestrator to deploy and manage containers and non-containerized applications across multiple platforms.WizWiz Threat Research has identified a broad cryptojacking campaign targeting publicly accessible DevOps web servers including exposed Nomad, Consul, Docker and Gitea applications. In the course of investigating this
Products
Consula broad cryptojacking campaign targeting publicly accessible DevOps web servers including exposed Nomad, Consul, Docker and Gitea applications. In the course of investigating this campaign, we observed attackersDockercryptojacking campaign targeting publicly accessible DevOps web servers including exposed Nomad, Consul, Docker and Gitea applications. In the course of investigating this campaign, we observed attackers exploiting aGiteacampaign targeting publicly accessible DevOps web servers including exposed Nomad, Consul, Docker and Gitea applications. In the course of investigating this campaign, we observed attackers exploiting a range ofGogsadd a post-receive script that runs with Gitea’s OS privileges. Note that this vulnerability also affects Gogs (CVE-2020-15867), from which Gitea was forked.Nomada broad cryptojacking campaign targeting publicly accessible DevOps web servers including exposed Nomad, Consul, Docker and Gitea applications. In the course of investigating this campaign, we observedWiz Dynamic ScannerThe Wiz Dynamic Scanner identifies publicly exposed instances of all the technologies mentioned in this blog post anywhere in your environment. In addition, it continuously checks for common misconfigurations that mayWiz Runtime Sensorworkload scanner detects containers and VMs infected with malware used in this campaign and the Wiz Runtime Sensor detects events and behaviors associated with this threat and similar ones, with robust rules for