A coin miner is software that uses a device’s CPU, GPU or cloud instance to generate cryptocurrency. It usually runs locally, inside a container or through malicious scripts, and is often detected by high resource use, unauthorised process execution or unusual outbound network activity.
What Coin Miners Are Used For
Coin miners are software intended to generate cryptocurrency by consuming local compute, container capacity, or rented cloud resources. In practice, the same behavior can be legitimate on owned infrastructure, or abusive when it appears without permission or outside approved workloads.
A miner is not defined by a specific malware family, delivery method, or platform. What makes it security-relevant is the resource abuse pattern: sustained CPU or GPU consumption, process execution that does not match the host’s normal purpose, and network activity that supports mining pools or related infrastructure.
How Coin Miners Commonly Operate
Miners often arrive as a standalone binary, a script, a container image, or a payload dropped by another compromise. They may be launched manually by an attacker, through scheduled execution, or by abusing a weakly controlled runtime such as a cloud instance or an exposed container environment.
Because mining is compute-bound, operators try to remain resident for long periods and may tune intensity to avoid immediate attention. That often means blending in with legitimate background activity, throttling load, or spreading across multiple hosts so the impact looks like ordinary performance degradation rather than a single obvious outbreak.
Why Coin Miners Matter to Security Teams
Coin miners matter because they convert infrastructure into an attacker-controlled utility. Even when they do not directly exfiltrate data, they create cost, stability, and visibility problems, and they can be a sign that an attacker already has execution on the host or in the cloud account.
On servers and cloud workloads, a miner can consume capacity that should support business services, drive up spend, and mask other malicious activity. On endpoints, it can slow systems, interfere with monitoring, and act as a foothold that survives longer than expected if defenders focus only on the high resource use.
For a practical defensive view of adversary tradecraft around execution, lateral movement, and credential abuse, the MITRE ATT&CK Enterprise Matrix is a useful companion reference, because miners are often one component of a broader intrusion chain rather than the whole incident.
Detecting and Responding to Coin Miner Activity
Detection usually starts with the basics: inventory what should be running, compare it to what is actually executing, and investigate persistent high CPU or GPU use that has no business justification. Security teams should also review outbound connections for suspicious pool-like destinations, unusual DNS patterns, and processes that appear only in containers or ephemeral cloud instances.
Response should focus on containment, then on finding the access path that made the miner possible. If the miner was introduced through a vulnerable service, an exposed management plane, stolen credentials, or a compromised container image, removing the binary alone will not stop reinfection.
Where cloud or container controls are part of the exposure, NIST SP 800-53 Rev 5 Security and Privacy Controls provides the control vocabulary for access control, audit, integrity, and configuration management, while SLSA helps frame build and artifact integrity when miners arrive through a compromised supply chain.
Risk and Threat Considerations
Coin miners are attractive because they monetize access quietly. The main risk is not just CPU exhaustion, but the fact that successful mining usually implies unauthorised execution somewhere in the environment, which can coexist with backdoors, persistence, or credential theft.
Failure mechanism: An attacker gains execution on a host, container, or cloud workload, then runs mining software that blends into legitimate background load while consuming local or rented resources.
Impact: The organisation pays for the attacker’s compute, loses performance headroom, and may miss a deeper compromise because the miner becomes the most visible symptom.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and SLSA set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Coin mining is a classic form of compute abuse described by this technique. |
| Recommendation — Map mining activity to Resource Hijacking and hunt for unauthorized compute abuse across hosts and cloud workloads. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Miners depend on outbound connectivity to pools and C2-like infrastructure. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Mining often surfaces through abnormal process and network telemetry that needs review. | |
| Recommendation — Restrict and monitor egress paths so mining traffic cannot freely reach external pools. Review audit data for sustained resource spikes, unusual process launches, and suspicious outbound connections. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Coin miners are a common malware payload and require detection and containment. |
| Recommendation — Use malware defenses to detect, isolate, and remove mining payloads and their persistence mechanisms. | ||
| SLSA | Supply-chain Levels for Software Artifacts | Supply-chain integrity matters when miners are introduced through poisoned images or builds. |
| Recommendation — Verify artifact provenance and reject untrusted images or builds that could carry mining payloads. | ||
Practitioner Guidance
Why practitioners should care: Treat a miner as an investigation trigger, not just a performance issue. If the only visible indicator is high resource use, the real question is how execution was authorised, how it persisted, and whether the same foothold could be reused for another payload.
What to watch for: Repeated miner detections on the same hosts, containers that spawn unexpected processes, and cloud workloads that show compute spikes without corresponding service demand are often signs that containment stopped the symptom but not the access path.
Related resources from NHI Mgmt Group
- What are the signs that a container has been compromised by a miner dropper or botnet loader?
- How should security teams detect crypto miner botnets on Linux endpoints before they spread laterally?
- What should security teams do first when a GitLab server may already be compromised by ransomware or miner activity?
- What happens when an internet-exposed GitLab server is compromised and the attacker deploys a miner?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org