Misconfigured Jenkins Servers Used for Cryptomining (Campaign)

Researchers observed attackers exploiting misconfigured Jenkins Script Consoles to gain remote code execution and deploy cryptocurrency miners. The malicious scripts search writable directories, download and decrypt miner binaries, kill competing high-CPU processes, and maintain persistence via cron jobs and systemd-run; many publicly exposed Jenkins servers (per Shodan) increase the attack surface. Remediation recommends identifying indicators of compromise, removing malicious files, and redeploying workloads from known clean states.