JenkinsMiner made $3.4 million in a few months by compromising Jenkins servers
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-1000353 | Unauthenticated Deserialization RCE in Jenkins CLI (≤2.56 / ≤2.46.1 LTS) CVE-2017-1000353 is an unauthenticated remote code execution flaw in the Jenkins CLI (CWE-502): an attacker can send a crafted serialized Java SignedObject to the remoting-based CLI endpoint, where it is deserialized with a new ObjectInputStream and bypasses Jenkins' existing blacklist-based deserialization protection. Triggering it requires only network reachability to the Jenkins remoting CLI — no authentication or user interaction — which is why the flaw scores 9.8 (critical) under CVSS 3.1. Successful exploitation gives arbitrary code execution with the privileges of the Jenkins process, i.e., full control of the CI/CD server and any credentials, source code, and build infrastructure it holds; Jenkins servers have historically been targeted for cryptomining campaigns such as JenkinsMiner, which reportedly generated $3.4 million. All Jenkins versions 2.56 and earlier and 2.46.1 LTS and earlier are affected, including Oracle Communications Cloud Native Core Automated Test Suite deployments that bundle affected Jenkins releases. Exploitation status is serious: a public proof-of-concept exploit exists (Exploit-DB 41965), EPSS estimates a 99.7% probability of exploitation within 30 days, and CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-10-02. Do: Upgrade to Jenkins 2.57 or later (weekly line) or 2.46.2 LTS or later, which add SignedObject to the deserialization blacklist, backport the HTTP CLI protocol, and deprecate/disable the remoting (Java serialization) CLI by default; as an interim mitigation, disable or restrict access to the remoting CLI (e.g., the /cli endpoint) from untrusted networks. Because the flaw is in CISA's KEV catalog, federal agencies must apply vendor mitigations or discontinue use per BOD 22-01, and all administrators of internet-facing Jenkins instances should check for signs of compromise such as cryptomining processes. Oracle Communications Cloud Native Core Automated Test Suite users should apply the applicable Oracle security patch/update addressing CVE-2017-1000353. | 9.8 | 100% | KEV PoC |
| mass≈1,000,000+ users / hundreds of thousands of installations, with tens of thousands of instances historically exposed to the internet |
Full article421 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 18, 2018
Hacker Group Makes $3 Million by Installing Monero Miners on Jenkins Servers
A criminal organization has made $3.4 million by compromising Jenkins servers and installing a Monero cryptocurrency miner dubbed JenkinsMiner.
“The perpetrator, allegedly of Chinese origin, has been running the XMRig miner on many versions of Windows, and has already secured him over $3 million worth of Monero crypto-currency. As if that wasn’t enough though, he has now upped his game by targeting the powerful Jenkins CI server, giving him the capacity to generate even more coins.” states a blog post published by CheckPoint.
Jenkins is the most popular open source automation server, it is maintained by CloudBees and the Jenkins community.
The automation server supports developers build, test and deploy their applications, it has more than 133,000 active installations worldwide with more than 1 million users.
According to the researchers, threat actors behind the massive mining operation were leveraging the CVE-2017-1000353 RCE vulnerability in the Jenkins Java deserialization implementation.
The vulnerability is due to lack of validation of the serialized object, its exploitation allowed the attackers to make Jenkins servers download and install the JenkinsMiner.
“The operation uses a hybridization of a Remote Access Trojan (RAT) and XMRig miner over the past months to target victims around the globe. The miner is capable of running on many platforms and Windows versions, and it seems like most of the victims so far are personal computers. With every campaign, the malware has gone through several updates and the mining pool used to transfer the profits is also changed.” continues the post.
Most of the downloads for the JenkinsMiner are from IP address located in China and assigned to the Huaian government information center, of course, we are not able to determine if the server was compromised or explicitly used by state-sponsored hackers.
Further details and IoCs are included in the analysis published by CheckPoint.
In January, security expert Mikail Tunç analyzed Jenkins servers exposed online discovering that many instances leak sensitive information.
Tunç highlighted that Jenkins typically requires credentials to the code repository and access to an environment in which to deploy the code, usually GitHub, AWS, and Azure. Failure to configure the application correctly can expose data to serious risk.
The researcher discovered that many misconfigured systems provided guest or administrator permissions by default, while others allowed guest or admin access to anyone who registered an account.
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(Security Affairs – JenkinsMiner, Monero cryptocurrency miner)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/69232/malware/jenkinsminer-targets-jenkins-servers.html