DEVOPS TOOLS TARGETED FOR CRYPTOJACKING

Summary from the TLDR InfoSec newsletter

Wiz researchers discovered a cryptojacking campaign called "JINX-0132" targeting misconfigured DevOps servers, including Nomad, Consul, Docker, and Gitea. Attackers exploit default settings and vulnerabilities to deploy XMRig miners, avoiding custom malware by using GitHub repositories. The campaign affects 25% of cloud environments, with 5% exposed and 30% misconfigured.