Join our Newsletter — 33% off our NHI Course

Cryptocurrency Mining Malware

Cryptocurrency mining malware is malicious software that secretly uses a device’s CPU, GPU, or cloud resources to mine cryptocurrency. It typically runs as a background process or injected payload, often aiming to evade detection while consuming power, slowing systems, and increasing infrastructure costs.

How Cryptocurrency Mining Malware Works

cryptocurrency mining malware, often called cryptojacking malware, turns a victim’s compute capacity into an attacker-controlled revenue stream. The core idea is simple: the code covertly consumes CPU, GPU, memory, and sometimes cloud infrastructure to solve mining workloads while trying to stay quiet enough to keep running.

The malware usually lands through a compromised host, malicious download, exposed management interface, or another initial access path, then establishes persistence and begins mining in the background. In cloud and virtualised environments, the abuse can extend beyond a single endpoint to shared clusters, containers, and orchestrated workloads, which is why the operational footprint can be much larger than the visible infection.

Why It Is Dangerous

The harm is not limited to slower devices. Mining activity creates sustained resource contention, higher electricity and cloud bills, reduced availability for legitimate workloads, and faster hardware wear. In enterprise environments, those costs can be distributed across servers, desktops, developer laptops, and cloud accounts before the abuse is noticed.

Because miners are designed to maximise uptime, they often employ throttling, process hiding, scheduled tasks, or watchdog behaviour to survive reboots and avoid attention. That means a low-visibility infection can remain profitable for the attacker while degrading performance and masking deeper compromise.

How Organisations Check Exposure

Exposure starts with inventory. Organisations need to know which endpoints, servers, containers, and cloud workloads are allowed to mine anything at all, and which ones should never be running unapproved compute-heavy processes. Internet-facing management planes, exposed credentials, and overly permissive cloud roles deserve special attention because they can turn a single foothold into broad mining abuse.

Useful checks include reviewing asset ownership, baseline CPU and GPU utilisation, container and orchestration telemetry, cloud billing anomalies, and vendor advisories for known infection paths. CIS Controls v8 is a good operational reference here because it ties inventory, logging, malware defence, and access control together in a way that helps surface unauthorised compute use.

Remediation, Detection, and Post-Incident Review

Removal usually requires more than deleting a process. If the attacker still has access, the system can be reinfected quickly, so organisations should treat miner removal as a compromise investigation. That means isolating affected hosts, identifying the initial entry point, revoking exposed credentials or tokens, and checking for persistence mechanisms such as startup entries, cron jobs, malicious containers, or cloud-init changes.

Detection is strongest when behavioural and infrastructure signals are combined. Sudden sustained CPU or GPU load, unusual outbound mining pool traffic, unexpected container churn, and cost spikes are all useful indicators. A post-patch or post-cleanup review should confirm that no related payloads, accounts, access keys, or scheduled jobs remain in place, especially in cloud environments where the same access path may be reusable.

Risk and Threat Considerations

Cryptocurrency mining malware is dangerous because it converts stolen compute into ongoing profit while remaining easy to overlook. The same foothold that enables mining can also be used for deeper compromise, and the longer it stays active, the more operational cost and visibility it consumes.

Failure mechanism: The malware abuses legitimate processing resources, then hides its activity well enough to survive normal user scrutiny, patching cycles, or routine performance monitoring.

Impact: Organisations can see degraded service, inflated cloud or power costs, reduced capacity for legitimate work, and a wider attack surface if the miner is only one component of a larger intrusion.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 provides the primary governance reference for this term.

Framework Control / Reference Relevance
CIS Controls v8 CIS-1 — Inventory and Control of Enterprise Assets Mining malware depends on unknown or unmanaged assets being missed.
CIS-8 — Audit Log Management Detection relies on logs and telemetry that expose abnormal compute and process behaviour.
CIS-10 — Malware Defenses Cryptocurrency mining malware is a malware class that should be blocked and detected operationally.
Recommendation — Inventory endpoints, servers, and cloud workloads so unauthorised miners stand out quickly. Centralise logs and alerts to spot sustained abuse and unusual outbound mining traffic. Deploy malware controls that detect, block, and quarantine cryptomining payloads.

Practitioner Guidance

Why practitioners should care: Treat mining malware as both a performance problem and a security event. If a host is unexpectedly maxing out compute, the question is not only “why is it slow?” but also “what access path allowed unapproved code to run here?”

What to watch for: Repeated CPU or GPU saturation, unexplained mining-pool destinations, and cost anomalies in cloud environments are practical early warnings. In containerised estates, watch for workloads that behave like they are designed to preserve persistence rather than deliver service.