A cryptomining campaign is a coordinated effort to secretly use someone else’s computing resources to mine cryptocurrency. Attackers typically compromise servers, cloud workloads, endpoints, or containers, then install mining software and persistence mechanisms. In cybersecurity terms, it creates unauthorized resource consumption, cost inflation, performance degradation, and a foothold for further intrusion.
How Cryptomining Campaigns Work
A cryptomining campaign is usually not a single infection event, but a repeatable intrusion pattern. Attackers compromise exposed infrastructure, then use the foothold to deploy miners, hide process activity, and keep access long enough to earn cryptocurrency at someone else’s expense.
The campaign model matters because the same access path can be reused across many hosts or clusters. That makes cryptomining a signal of both compromise and operational abuse: the attacker is consuming CPU, memory, GPU, and power, while the victim absorbs degraded service and higher cloud spend.
Common Entry Paths and Deployment Patterns
Most campaigns begin with weak authentication, exposed management interfaces, stolen credentials, or vulnerable workloads. In cloud and container environments, attackers often look for overprivileged service accounts, open orchestration endpoints, or misconfigured APIs that let them run code or schedule new workloads.
Once inside, they typically install miner binaries, scripts, or containerized payloads, then add persistence through startup tasks, cron jobs, or cloud-native automation. Some campaigns also disable or evade security tooling so the mining process survives reboot, scaling events, and routine administrator activity.
Why Cryptomining Campaigns Are Operationally Dangerous
Cryptomining is dangerous even when it appears “only” to waste resources. It can starve production services, trigger autoscaling, distort monitoring, and create unexpected cloud cost spikes. In shared environments, mining activity can also interfere with other tenants or workloads by monopolizing compute and network capacity.
The deeper concern is that miners rarely arrive alone. The compromise that enabled mining may also give attackers access to credentials, internal networks, or deployment pipelines. That turns a cost abuse event into a broader security issue, because the same foothold can support recon, lateral movement, or follow-on payloads.
Detection and Response Focus Areas
Defenders usually detect cryptomining through unusual CPU or GPU saturation, sustained outbound pool connections, unfamiliar processes, suspicious container images, or repeated creation of short-lived workloads. Cloud billing anomalies and sudden performance regression are often among the earliest clues.
Response should focus on removing the miner, identifying the initial access vector, and reviewing whether any credentials, keys, or access tokens were exposed during the compromise. If the attacker had persistent access, treat the incident as more than a resource-drain event and review the host, workload, and adjacent accounts for additional compromise.
Risk and Threat Considerations
Cryptomining campaigns create a blend of availability risk and intrusion risk. The immediate harm is resource exhaustion and cost inflation, but the same access used for mining may also support persistence, credential theft, and secondary malware deployment.
Failure mechanism: Attackers exploit exposed or weakly protected systems, then preserve access by hiding mining activity inside legitimate-looking services, containers, or scheduled jobs. The environment may stay “functional” while quietly burning compute and masking a wider compromise.
Impact: Organisations can see degraded performance, cloud bill shock, disrupted operations, and delayed detection of more serious attacker activity. In high-scale environments, that can translate into systemic cost leakage and loss of trust in monitoring signals.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Defines cryptomining as attacker-driven resource hijacking. |
| Recommendation — Map miner behaviour to T1496 and hunt for resource-abuse patterns across affected hosts and workloads. | ||
| NIST SP 800-53 Rev 5 | SC-44 — Detention and Handling of Information at Rest | Supports limiting unauthorized compute and persistence abuse through system protection controls. |
| Recommendation — Strengthen system protection and monitoring to detect unauthorized execution and sustained resource abuse. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | Cryptomining campaigns often start with exposed or unpatched systems that require active vulnerability management. |
| Recommendation — Continuously inventory, patch, and validate exposed assets that could be used to launch mining payloads. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potential cybersecurity events | Cryptomining is commonly detected through anomalous resource use and outbound mining traffic. |
| Recommendation — Monitor host and network telemetry for mining pools, CPU spikes, and unusual outbound connections. | ||
| OWASP Non-Human Identity Top 10 | NHI-05 — Overprivileged NHI | Cloud and workload identities with excessive privilege are a common enabler of mining deployment. |
| Recommendation — Reduce workload and service-account privilege so a compromised identity cannot launch mining infrastructure. | ||
Practitioner Guidance
What to watch for: Treat unexplained resource growth as a security signal, not just an operations issue. Miner activity often becomes obvious only after comparing workload behaviour, cloud spend, and process lineage across hosts or clusters.
Governance implication: Cryptomining campaigns are easiest to contain when compute ownership, secret handling, and deployment permissions are clearly assigned. If a team cannot explain which identities can launch workloads or why a host has internet reachability, the environment is likely overexposed.
Related resources from NHI Mgmt Group
- What are the signs that a containerised cryptomining campaign is escalating beyond initial compromise?
- Who is accountable for third-party access after a campaign or project ends?
- Why do campaign-based reviews often miss NHI risk?
- What breaks when AI agents can chain benign requests into a malicious campaign?