A commodity miner is malware that monetises an infected system by using its CPU or GPU to mine cryptocurrency. It often favours quiet persistence, low-noise command-and-control, and minimal user-visible disruption over data theft, because survival time directly affects profit.
What Commodity Miners Are
Commodity miners are a common malware category rather than a single family. They hijack infected hosts to mine cryptocurrency, usually by consuming CPU or GPU resources while trying to stay active long enough for the attacker to profit.
That makes them different from smash-and-grab malware that burns out a system quickly. Their business model depends on persistence, low operational noise, and avoiding obvious disruption that would trigger removal.
How Commodity Miners Operate
Most miners arrive through familiar intrusion paths such as exposed services, weak credentials, malicious downloads, or vulnerable software. Once inside, they drop a mining payload, establish persistence, and often tune resource use so the host still appears usable.
They may throttle activity, hide their process names, abuse legitimate tools, or disable security controls to reduce detection. In some cases, the miner itself is only one stage in a broader intrusion, with the same access later reused for other malicious activity.
Why Commodity Miners Matter
Although mining malware is often framed as nuisance software, it creates real security and business impact. It can drive cloud and energy cost spikes, degrade workstation or server performance, shorten hardware life, and indicate that an attacker already has durable foothold on the environment.
Commodity miners also matter because they compete for the same scarce resources that production services need. On shared servers, virtual machines, or containers, a miner can become an availability issue even before it becomes an obvious security incident.
Commodity miners often reveal weak patching, poor credential hygiene, or exposed management interfaces, which is why they are frequently discussed alongside broader malware and intrusion-detection guidance in MITRE ATT&CK Enterprise Matrix and NIST Cybersecurity Framework 2.0.
Commodity Miner Detection and Response Signals
Practical detection usually starts with resource anomalies, especially sustained high CPU or GPU usage, unexplained fan activity, sudden power draw, or processes that respawn after termination. Network indicators can include regular beaconing to mining pools, proxy use, or outbound traffic that does not fit the host’s normal role.
Response is usually simpler when the miner is isolated early, because the infection may be opportunistic rather than deeply embedded. A good investigation still needs to answer how the initial access happened, whether persistence exists elsewhere, and whether the host was used for anything beyond mining.
For defenders who want a control baseline, the host-hardening and access-control guidance in NIST SP 800-53 Rev 5 Security and Privacy Controls and the endpoint hardening discipline behind CIS Benchmarks are directly useful because commodity miners often succeed where software hygiene is weak.
Risk and Threat Considerations
Commodity miners are not just a performance problem, they are a persistence problem. Their profitability increases when they remain hidden, so they frequently blend into normal system load and can coexist with more serious compromise indicators.
Failure mechanism: An attacker abuses compute resources on an already-compromised host, keeps the payload lightweight, and uses persistence plus low-noise operation to prolong dwell time and revenue generation.
Impact: The organisation absorbs lost capacity, higher operating cost, degraded service performance, and a stronger likelihood that the host is part of a wider intrusion rather than a standalone nuisance.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Commodity miners directly exemplify adversary resource hijacking for cryptocurrency mining. |
| Recommendation — Map mining activity to T1496 and hunt for sustained compute abuse, persistence, and pool connections. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and physical devices are monitored to detect potential cybersecurity events | Mining malware is commonly detected through abnormal resource and network telemetry. |
| Recommendation — Monitor host and network telemetry for unusual compute spikes and mining-pool traffic. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Commodity miners are found and contained through continuous system and process monitoring. |
| Recommendation — Instrument system monitoring to flag abnormal processes, resource spikes, and persistence changes. | ||
| CIS Controls v8 | CIS-1 — Inventory and Control of Enterprise Assets | Miner infections often exploit unmanaged or exposed assets that fall outside effective control. |
| CIS-10 — Malware Defenses | Commodity miners are a malware class and are directly addressed by malware defense controls. | |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | Miner infections are easier where software and host configurations are weak or exposed. | |
| Recommendation — Maintain accurate asset inventory so exposed hosts can be identified and remediated quickly. Use malware defenses to detect, block, and isolate mining payloads and droppers. Harden exposed systems to reduce the attack surface that miners commonly exploit. | ||
Practitioner Guidance
What to watch for: Treat unexpected mining behaviour as an investigation trigger, not just a cleanup task. A miner on a production asset should prompt review of access paths, persistence, patch status, and lateral movement risk because the same foothold often exposes more than one control failure.
Practitioner takeaway: If a miner survives long enough to matter financially, your control gap is usually larger than the mining process itself.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org