PANews reported on June 4 that, according to The Register, a hacker group with the modern name JINX-0132, a security company named Wiz, is massively exploiting DevOps tool configuration vulnerabilities to carry out cryptocurrency mining attacks. The attack focused on tools such as HashiCorp Nomad/Consul, Docker API, and Gitea, and about 25% of cloud environments were at risk. Attack methods include: deploying XMRig mining software using Nomad's default configuration, executing malicious scripts through Consul's unauthorized API, and controlling the creation of mining containers by exposing Docker APIs. Wiz data shows that 5% of DevOps tools are directly exposed to the public network, and 30% of them have configuration defects. The security team advises users to keep their software up to date, disable non-essential features, and restrict API access.
This attack once again highlights the importance of configuration management in cloud environments. The official documentation from HashiCorp had previously warned of the associated risks, yet a large number of users have still not enabled basic security features. Experts emphasize that simple configuration adjustments can block the majority of automated attacks.
View Original
The content is for reference only, not a solicitation or offer. No investment, tax, or legal advice provided. See Disclaimer for more risks disclosure.
Hackers use public DevOps tools for crypto mining attacks, with about 25% of cloud environments at risk.
PANews reported on June 4 that, according to The Register, a hacker group with the modern name JINX-0132, a security company named Wiz, is massively exploiting DevOps tool configuration vulnerabilities to carry out cryptocurrency mining attacks. The attack focused on tools such as HashiCorp Nomad/Consul, Docker API, and Gitea, and about 25% of cloud environments were at risk. Attack methods include: deploying XMRig mining software using Nomad's default configuration, executing malicious scripts through Consul's unauthorized API, and controlling the creation of mining containers by exposing Docker APIs. Wiz data shows that 5% of DevOps tools are directly exposed to the public network, and 30% of them have configuration defects. The security team advises users to keep their software up to date, disable non-essential features, and restrict API access. This attack once again highlights the importance of configuration management in cloud environments. The official documentation from HashiCorp had previously warned of the associated risks, yet a large number of users have still not enabled basic security features. Experts emphasize that simple configuration adjustments can block the majority of automated attacks.