The JINX-0132 campaign targets misconfigured and exposed DevOps tools—primarily HashiCorp Nomad, Consul, Docker Engine API, and Gitea—to deploy XMRig cryptocurrency miners. In Nomad, attackers exploit the default-permissive job API to remotely submit jobs that execute shell commands, downloading the miner directly from GitHub. Offensive or arbitrary job names are often used to avoid detection.

In Consul, the attacker registers rogue services and leverages script-based health checks to execute mining payloads. Without adequate access control lists (ACLs), this method enables remote code execution across connected nodes.

Misconfigured Docker APIs exposed to the internet (tcp://0.0.0.0:2375/2376) allow attackers to create privileged containers, mount host filesystems, and deploy miners with root access. Gitea instances are compromised through various paths, including CVE-2020-14144 and insecure installation scripts, which permit attackers to gain administrative access or execute malicious Git hooks.

The attacker avoids custom malware, instead relying on official open-source tools and public repositories—particularly GitHub—to deliver payloads. This “living-off-open-source” approach minimizes forensic evidence, with the only consistent indicator of compromise (IOC) being the Monero wallet address used for mining rewards.