Cloud workloads running these tools are especially at risk. Once compromised, attackers siphon off significant computing power, resulting in unexpected cloud bills and slower application performance. Some affected Nomad clusters managed hundreds of clients, proving that even large, well-funded enterprises can be covertly drained due to simple misconfigurations.
Lockdown of DevOps exposure
Wiz urges organizations to lock down exposed DevOps infrastructure by following established best practices. For Nomad, enforcing access control lists (ACLs) would have blocked the unauthenticated job executions used in this campaign. Public Gitea instances should be fully patched, with git hooks disabled and the installation locked unless absolutely needed.
In Consul, disabling script checks and binding the HTTP API to localhost can prevent unauthorized service access. As for Docker, the API is meant to stay internal — exposing it to the internet, especially via 0.0.0.0, opens a direct path for exploitation. Minimizing external exposure, enabling authentication, and applying least-privilege access across all tools are critical steps to stop similar attacks in their tracks.
