{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"JINX-0132: How Cryptojackers Hijacked DevOps Infrastructure via Nomad and Docker","html":"","width":"100%","height":180,"duration":4042,"description":"In this episode, we dissect the JINX-0132 cryptojacking campaign — a real-world example of how threat actors are exploiting cloud and DevOps environments to mine cryptocurrency at scale.\nWe unpack how cybercriminals targeted misconfigured Docker APIs, publicly exposed HashiCorp Nomad and Consul servers, and vulnerable Gitea instances — turning enterprise-grade compute resources into crypto-mining farms, all while staying under the radar. This campaign marks the first publicly documented exploitation of HashiCorp Nomad in the wild.\nWe discuss:\nHow attackers used XMRig, cron jobs, and process-hiding tools to persist and evade detection\nThe impact of misconfiguration and unpatched vulnerabilities in fast-moving DevOps workflows\nThe financial and operational cost of unauthorized crypto mining in the cloud\nThe role of DevSecOps in preventing these attacks, with actionable recommendations for securing your containers and runtimes\nKey practices to “shift left” and catch security flaws early in the software development lifecycle\nWhy Cloud Workload Protection Platforms (CWPP) are becoming essential in defending modern cloud-native environments\nWe also highlight best practices for hardening Docker images, avoiding privileged containers, monitoring system behavior, and responding to incidents with speed and precision.","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}