Hackers Use Jenkins Access to Deploy DDoS Botnet Against Gaming Servers

Why It Matters

The incident underscores how vulnerable DevOps pipelines can be weaponized, threatening high‑value gaming infrastructure and prompting urgent hardening across the industry.

Key Takeaways

• Jenkins scriptText endpoint enables remote code execution if mis‑configured.
• Bot drops Windows exe and Linux binary from IP 103.177.110.202.
• Malware disguises as kernel threads to avoid detection.
• Targets Valve Source Engine, flooding ports 27015, 53, 123.
• Single Vietnamese IP serves as access, payload, and C2 hub.

Pulse Analysis

Jenkins is a cornerstone of modern CI/CD workflows, yet its scriptText endpoint remains a frequent misconfiguration target. When left exposed, attackers can inject Groovy code that grants full remote code execution, effectively turning a build server into a foothold for broader campaigns. This vector bypasses traditional perimeter defenses because the compromised Jenkins instance often resides within trusted network zones, making detection harder for security teams that focus on external threats.

The newly uncovered botnet leverages both Windows and Linux payloads to infiltrate game servers, then masquerades as benign kernel threads such as ksoftirqd. By opening a command channel on TCP port 5444, the actors can issue game‑specific DDoS commands, notably the attack_dayz routine that forces the Valve Source Engine to emit massive query responses. This method overwhelms ports commonly used by multiplayer titles—27015 for game traffic, 53 for DNS, and 123 for NTP—causing server crashes that disrupt player experiences and revenue streams during peak gaming periods.

For operators, the lesson is clear: CI/CD tools must be treated as critical assets, not just development conveniences. Regular audits of Jenkins configurations, strict network segmentation, and real‑time monitoring of script execution can close the attack surface. Moreover, integrating threat intelligence on known malicious IPs, such as the Vietnamese provider used in this campaign, adds an extra layer of defense. As the gaming sector continues to attract sophisticated adversaries, proactive hardening of development pipelines will be essential to safeguard both infrastructure and the player community.