If you’re running an Apache NiFi instance exposed on the internet and you have not secured access to it, the underlying host may already be covertly cryptomining on someone else’s behalf. The attack Indicators of the ongoing campaign were first spotted by the SANS Internet Storm Center when, on May 19th, their distributed sensor network detected a significant spike in requests for “/nifi.” After redirecting some of the requests to their honeypot system running the … More
The post Someone is roping Apache NiFi servers into a cryptomining botnet appeared first on Help Net Security.
