Threat actors have been observed exploiting multiple critical vulnerabilities in OpenMetadata, a popular open-source metadata management tool, to carry out a Kubernetes cryptomining campaign. The vulnerabilities, identified as CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, and CVE-2024-28254, include several critical remote code execution and authentication flaws, allowing attackers to hijack unpatched, internet-exposed OpenMetadata workloads. Since early April 2024, these vulnerabilities have enabled threat actors to execute code remotely, perform reconnaissance, and download cryptomining malware from a command-and-control (C2) server located in China. The attackers set up persistent access through cron jobs and Netcat reverse shells, and even leave notes pleading for Monero donations to buy a car or “suite” in China. This situation underscores the crucial importance of using strong authentication, keeping software up to date, and adhering to security best practices in containerized environments to prevent exploitation. CTIX analysts urge all OpenMetadata administrators to ensure their instances are up-to-date.