---
id: 7007
title: "Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/exposed-jdwp-exploited-in-the-wild"
published_at: "2025-07-02T15:00:13Z"
tags: ["rce", "teamcity", "misconfiguration", "honeypot", "cryptomining", "wiz-research", "jdwp"]
phying_url: "https://phying.com/item/7007"
lang: en
---

# Exposed JDWP Exploited in the Wild: What Happens When Debug Ports Are Left Open

## Summary

Wiz Research documents an intrusion via an exposed JDWP debug port: attackers went from a TeamCity honeypot to RCE in hours, planting a modified XMRig miner with persistence and mining-pool proxies.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2025-07-02T15:00:13Z
- **Original:** https://www.wiz.io/blog/exposed-jdwp-exploited-in-the-wild
- **Phying News:** https://phying.com/item/7007