Hackers Exploiting Jenkins Script Console for Cryptocurrency Mining Attacks

Trend Micro researchers discovered that misconfigured Jenkins Script Console endpoints exposed on the Internet can be abused to achieve remote code execution; attackers have used a Base64-encoded Groovy script to deploy a cryptocurrency miner (hosted on berrystore.me), establish persistence, and manage CPU usage. The report warns administrators to enforce authentication and authorization, audit instances, and avoid publicly exposing Jenkins to mitigate this active threat.