Cryptojackers Caught Mining Monero via Exposed DevOps Infrastructure

Security researchers at Wiz on Monday raised an alarm catching a malicious hacker hijacking misconfigured DevOps infrastructure for cryptocurrency mining in what appears to be the first documented abuse of HashiCorp Nomad servers in the wild. 

The campaign, active since at least April, also latches onto exposed Consul dashboards, Docker Engine APIs and Gitea code-hosting instances to push the open-source XMRig miner, all fetched directly from public GitHub releases to avoid leaving easy forensic fingerprints. 

According to documentation from Wiz, hackers are abusing the HashiCorp Nomad job-queue API when administrators leave the scheduler in its default, unauthenticated state.

Wiz said its threat hunters watched the attackers drop shell commands that download and launch the Monero cryptocurrency miner, then repeat the trick across dozens of randomly named jobs. 

Wiz noted that Consul’s service-health checks, Docker’s unsecured TCP socket and several long-patched Gitea vulnerabilities provide similar remote-code-execution openings when left exposed.

The cloud security vendor said its telemetry suggests a quarter of cloud environments run at least one of these DevOps tools with about 5% directly reachable from the internet, and nearly a third of those internet-facing deployments are wide-open through bad defaults or skipped hardening. 

“Among those exposed deployments, 30% are misconfigured,” Wiz warned.

In one case, Wiz researchers said the attackers tapped a Nomad cluster with hundreds of clients whose combined CPU and RAM would cost “tens of thousands of dollars per month” if paid for legitimately, resources that instead churned out cryptocurrency on behalf of a single wallet address. 

“A key characteristic of this threat actor’s methodology is the deliberate avoidance of unique, traditional identifiers that could be used by defenders as IOCs. Instead, they download tools directly from public GitHub repositories and rely on standard release versions of XMRig rather than custom malware,” Wiz noted.

Instead, the company recommends locking down Nomad and Consul with ACLs, keeping Gitea fully patched, and never exposing the Docker API to the open internet. 

“Misconfiguration abuse by threat actors can often go under defenders’ radar, especially if the affected application isn’t well known as an attack vector,” Wiz researchers said.

Related: US Sanctions Philippine Company for Supporting Crypto Scams

Related: Cryptocurrency Thieves Hijacking Zoom ‘Remote Control’ Feature

Related: US Seizes Garantex in Cryptocurrency Money Laundering Bust

Related: How Social Engineering Sparked a Billion-Dollar Supply Chain Cryptocurrency Heist