Are you a shadow crypto factory?

 

Speaking of DevSecOps, are your pipelines secured or are they making illicit crypto?

Why the CI/CD gold-rush now targets your CPU cycles

Over the past few years, attackers have moved from smashing storefronts to skimming the till. 2025’s flavour of “digital skimming” is cryptojacking inside DevOps tooling. A recently documented campaign, codenamed JINX-0132, scans the internet for self-hosted HashiCorp Nomad / Consul clusters, Docker APIs, and lightweight Git alternatives such as Gitea, slips in—or sometimes just uses the default credentials—and spins up XMRig miners in your own CI/CD runners. The crooks exfiltrate the Monero; you foot the cloud bill. Two uncomfortable facts stand out:

• 25 % of cloud environments run at least one of these four tools.
• 30 % of those instances are mis-configured, and 5 % are wide-open to the public Internet. (wiz.io, theregister.com)

That intersection of popularity and misconfiguration explains why DevOps platforms have overtaken web servers on attackers’ shopping lists.

Anatomy of the JINX-0132 playbook:

The campaign is elegant in its banality:

Stage	TTPs in plain English
Recon	Shodan & Censys sweeps for default ports (4646 Nomad, 8300 Consul, 2375 Docker, 3000 Gitea)
Initial access	Default creds, weak ACLs, or the “bind everything to 0.0.0.0” mis-step in container labs
Persistence	Adds a service/replication job inside Nomad or a systemd unit inside the container host
Execution	Drops a minimal Alpine image containing xmrig or cpuminer
Evasion	CPU-limits mimic normal build spikes; miner binary is named agent-runner or cache-worker
Cash-out	Payout addresses rotate weekly; traffic proxied over Cloudflare Workers

Key takeaway: the attackers never need a supply-chain zero-day—misconfiguration is enough. They rely on operators accepting noisy network diagrams marked “DEV/OPS : trusted” without putting controls between the two.

How exposed are we? (Chart & numbers)

The bar chart above visualises Wiz’s field telemetry across 45 000 cloud accounts sampled in May 2025. In words:

• 1 in 4 cloud estates has at least one Nomad/Consul/Docker-API/Gitea node.
• Nearly a third of those nodes miss critical hardening steps (TLS off, anonymous auth on).
• 1 in 20 is outright public.
• Independent of exposure, 20 % of estates run Consul agents they forgot about years ago. (wiz.io)

Ops déjà-vu: these percentages mirror 2017’s unsecured-Kubernetes problem. History repeats—first as pods, then as pipelines.

Why pipelines make perfect crypto-mints

Attackers love: persistent compute + outbound Internet + predictable load bursts—a textbook CI runner:

1. Autoscale is their free power supply. Cloud-native build agents scale up for heavy merges and sit idle otherwise; cryptominers max out those downtimes.
2. Build caches bypass egress filters. Artifact stores (NuGet, npm, Maven) already talk to the outside world; slipping in an extra DNS-over-HTTPS tunnel is trivial.
3. Secrets are everywhere. Github PATs, container registries, and database creds sit inside variables—the jackpot for lateral movement.
4. “Temporary” often means “never decommissioned.” A proof-of-concept runner set up for one sprint becomes a zombie miner next quarter. (techradar.com, binance.com)

A DevSecOps hardening blueprint (people-first, tool-agnostic)

Mindset shift: DevSecOps isn’t “DevOps + an antivirus job.” It’s DevOps done right, where every pipeline stage carries a policy guardian and every code/config merge review includes security acceptance criteria.

Quick wins (≤ 1 hour each)

• Close the management plane: bind Nomad/Consul listeners to 127.0.0.1; front with NGINX + mutual-TLS.
• Enable signed images: enforce Docker Content Trust or Notary v2 so rogue layers fail the pull.
• Rate-limit new runners: require human approval (or a ChatOps slash-command) before autoscaling > N nodes.

Medium effort (1-2 days)

• Shift-left secrets scanning: integrate TruffleHog or Microsoft CredScan into pull-request checks; fail fast.
• Policy-as-code: adopt Open Policy Agent (OPA) or HashiCorp Sentinel rules in Terraform/Terragrunt; prohibit 0.0.0.0/0 and plaintext environment variables.
• Immutable build images: maintain golden-image pipelines (Packer, Azure Image Builder) that rebuild weekly with patched OS baselines.

Strategic moves (this quarter)

• Threat-model your pipeline like an application. Document data-flows, trust boundaries and abuse cases—then red-team them.
• Adopt attestation down to the artifact. Sigstore’s Fulcio + Rekor can verify that the binary in prod was really built by GitHub Actions Job 123.
• Make ops-ownership explicit. A brown-bag training on “The Big DevSecOps Change” helps teams see security as a shared reliability feature, not an external gate.

Call to action: turn miners into mentors

No CISO wants Monday-morning headlines about “Accidental Crypto Farm Spotted in Customer CI.” Yet the fix is rarely another scanner; it is discipline in configuration and psychological safety to flag bad defaults.

1. Ask your pipeline: “If an intern can spin up a prototype, can an attacker?”
2. Budget 10 % sprint capacity for debt-shaving hardening stories: treat them like feature work.
3. Celebrate security merges the same way you celebrate performance gains. Culture is cumulative.

TL;DR : The DevOps tools you love might already be printing money—for someone else. Harden them, monitor them, and let “The Big DevSecOps Change” ring true: secure by default, collaborative by design.

---

Further reading

• Wiz Blog :  DevOps Tools Targeted for Cryptojacking (2025-06-02) (wiz.io)
• The Register :  Illicit crypto-miners pouncing on insecure DevOps tools (2025-06-03) (theregister.com)
• TechRadar :  Public DevOps tools targeted by criminals to steal crypto (2025-06-05) (techradar.com)