Notifications
Clear all
Topic starter
20/08/2026 5:37 pm
TL;DR: Unauthorized XMRig deployments are appearing across Windows, Linux, Kubernetes, and AWS EC2, with attackers using exposed credentials, SSH brute force, commodity malware, and software vulnerabilities to install a miner that can persist and consume resources, according to Expel. The pattern matters because cryptomining is often the visible symptom of a wider access-control failure, not the end of the intrusion.
NHIMG editorial — based on content published by Expel: LLMjacking: How Attackers Hijack AI Using Compromised NHIs
By the numbers:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Only 5.7% of organisations have full visibility into their service accounts.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: What breaks when cryptominers appear in enterprise systems?
A: Cryptominers usually mean the attacker already has a foothold, so the real failure is access control, not just malware execution.
Q: Why do NHI and cloud controls matter when attackers deploy miners?
A: Because miners are often installed through stolen service access, remote admin tools, or workload abuse.
Q: How do security teams know whether mining activity is legitimate or malicious?
A: They should correlate sustained CPU usage with network destinations, persistence artefacts, and system ownership.
Practitioner guidance
- Harden remote administration pathways Inventory SSH, RDP, and remote management tools, then restrict them with MFA, source-IP controls, and explicit allowlists so brute force and stolen credentials cannot be reused at scale.
- Correlate persistence with change control Alert on new scheduled tasks, cron jobs, and registry startup items on systems that should not introduce mining software, and require change tickets for any sanctioned startup modification.
- Baselining cloud and container compute use Set CPU and network baselines for pods and EC2 instances, then investigate sustained high CPU, especially when paired with outbound traffic to mining pools or uncommon encrypted sessions.
What's in the full article
Expel's full article covers the operational detail this post intentionally leaves for the source:
- Exact installation paths seen in recent XMRig incidents, including how different initial-access methods led to deployment.
- Practical detection indicators such as mining pool traffic, off-hours CPU spikes, and persistence artefacts across Windows, Linux, Kubernetes, and AWS.
- Cloud-specific guidance on AWS GuardDuty and Runtime Monitoring for unauthorised miners.
- Defensive checks for Kubernetes pod security policies that help constrain cryptomining workloads.
👉 Read Expel's analysis of XMRig deployment across endpoints, Kubernetes, and AWS →
XMRig in endpoints, Kubernetes, and AWS: what controls are missing?
Explore further
20/08/2026 6:22 pm
Cryptomining is a control-failure indicator, not a standalone threat. XMRig usually appears after access has already been lost somewhere in the environment, which makes it a useful signal for broader governance gaps. The presence of a miner tells practitioners that credentials, remote administration, or workload hardening were already inadequate. The right conclusion is not that mining is harmless, but that it often marks the point where deeper compromise became visible.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
A question worth separating out:
Q: What should teams do when XMRig is discovered on a host or cluster?
A: Contain the system, identify how the attacker got in, and review associated credentials, startup mechanisms, and neighbouring assets. Removal alone is not enough because the same path could be reused for a more damaging payload. The investigation should determine whether the issue came from exposed credentials, brute force, or a vulnerable service.
👉 Read our full editorial: Unauthorized XMRig deployment shows broader control gaps in cloud estates
