Turning Jenkins Into a Cryptomining Machine From an Attacker's Perspective

Tags

External References

• https://www.trendmicro.com/
• https://www.trendmicro.com/
• https://otx.alienvault.com/

Description

This report analyzes how threat actors can exploit misconfigured Jenkins servers to execute malicious Groovy scripts, leading to activities like deploying cryptocurrency miners. Misconfigurations exposing the /script endpoint allow remote code execution, enabling attackers to run scripts that download and execute miner binaries while maintaining persistence through cron jobs and systemd utilities.

Date