Cryptominer

Expanded Definition

In NHI security, a cryptominer is best understood as an unauthorised workload that consumes compute, storage, and network resources to generate cryptocurrency. The software may be legitimate in a lab or sanctioned cloud environment, but in incident response it usually signals misuse of an environment rather than a business-approved capability. That distinction matters because the security question is not whether mining is technically possible, but whether the process was deployed, persisted, or scaled without approval.

Usage in the industry is still evolving around related terms such as coin miner, miner dropper, and cryptojacking. In practice, these often overlap: a miner payload may arrive through a compromised container image, an abused API key, or a vulnerable CI/CD runner, then maintain itself through startup scripts, scheduled tasks, or privileged service accounts. The most relevant control concern is unauthorised execution authority, not the mining algorithm itself. For broader identity and control context, NHI Management Group’s Ultimate Guide to NHIs is a useful reference, and the NIST Cybersecurity Framework 2.0 provides the governance lens that turns resource abuse into an asset protection issue.

The most common misapplication is treating cryptomining as simple misuse of CPU, which occurs when teams ignore the underlying identity, persistence, or workload compromise that allowed the miner to run.

Examples and Use Cases

Implementing cryptominer detection rigorously often introduces a performance-versus-visibility tradeoff, because more granular telemetry can help stop abuse faster but also increases monitoring cost and operational noise.

• A compromised Kubernetes cluster launches a miner pod after an attacker abuses a weakly scoped service account token, turning spare cluster capacity into hidden revenue for the attacker.
• A cloud function or VM is infected through a vulnerable dependency, then persists through a startup script and burns through the organisation’s metered compute budget.
• A developer workstation with exposed secrets is enrolled into a botnet that deploys a miner, using the stolen credentials to pull additional payloads from object storage.
• A CI/CD runner is hijacked to mine during off-hours, revealing that build automation credentials had broader access than the pipeline required.
• An internal security team validates suspicious spikes in CPU and outbound traffic against cloud logs and service account activity, then correlates the event with guidance from the Ultimate Guide to NHIs and the detection priorities in the NIST Cybersecurity Framework 2.0.

Why It Matters in NHI Security

Cryptominers are important to NHI security because they are often the visible symptom of a deeper identity failure: over-privileged service accounts, exposed API keys, weak workload isolation, or unreviewed automation. Once a miner is running, the same access path can often be used for data theft, lateral movement, or sabotage, so the incident is rarely limited to wasted compute. NHI Management Group notes that 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage, which helps explain why miner incidents frequently coexist with broader compromise. That pattern aligns with the NIST Cybersecurity Framework 2.0 emphasis on asset management, access control, and continuous detection.

For NHI practitioners, cryptomining also matters because it exposes unmanaged identities that were never intended to exist beyond a narrow task. If a miner can persist, then a token, certificate, or workload identity likely has too much reach or too long a lifetime. Organisations typically encounter the real cost only after a bill spike, service degradation, or incident response investigation, at which point cryptominer containment becomes operationally unavoidable to address.