A cryptomining botnet is a group of compromised devices remotely controlled to mine cryptocurrency without the owners’ consent. Technically, it is an NHI-driven attack chain where malware uses stolen or abused credentials, command-and-control infrastructure, and distributed compute resources to generate digital currency, often degrading performance and increasing cloud or endpoint costs.
What a cryptomining botnet is made of
A cryptomining botnet is not just malware on one host. It is a coordinated control plane that turns many compromised systems into a shared compute pool, usually by combining infection, remote command, and a mining payload that can run quietly in the background.
The important security detail is that the attacker needs persistence more than speed. Once a host is enlisted, it can keep generating value for the operator until defenders remove the malware, revoke access, or shut down the control path.
How cryptomining botnets get operational
These botnets often begin with an exposed service, stolen credentials, weak authentication, or a vulnerable internet-facing system. After initial access, the operator typically drops a miner, installs persistence, and links the device to command-and-control infrastructure so it can receive updates or mining instructions.
That control layer matters because it lets attackers change behaviour at scale. A compromised endpoint can be switched from mining to scanning, lateral movement, or additional payload delivery if the operator wants to monetise the access in a different way. Storm-1283 OAuth apps abuse 2023 is a useful example of how stolen or abused credentials can be converted into cloud compute abuse.
Why cryptomining botnets are so costly
Mining consumes CPU, GPU, memory, power, and sometimes cloud credits, so the impact is not limited to security teams. Users notice lag, elevated temperatures, degraded service quality, or rising infrastructure bills before they realise the system is compromised.
The damage also accumulates quietly. Even when the mining activity looks “low severity” compared with ransomware or data theft, the organisation can still absorb direct cost, reduced availability, and secondary risk from the same foothold that enabled the miner. ShadowRay 2024 shows how exposed compute environments can be abused for cryptocurrency mining after attackers gain access to shared resources.
What defenders should look for in a cryptomining botnet
Detection usually starts with resource anomalies, not the miner itself. Sudden sustained CPU or GPU use, unexplained outbound traffic to mining pools, unknown scheduled tasks, odd container activity, and unfamiliar processes on servers or endpoints are all useful signals.
Because the same compromise path can be reused, defenders should also inspect adjacent signs of abuse such as new accounts, unusual tokens, changed startup items, and exposed management interfaces. Langflow Flodrix botnet 2025 is a reminder that internet-exposed services can be turned into botnet infrastructure once attackers find a usable entry point. Carbonato botnet 2026 likewise illustrates how botnet operators can harvest credentials and tokens while expanding their compute footprint.
How to reduce exposure to cryptomining botnets
The best defence is to reduce the number of ways an attacker can obtain and keep control. That means hardening exposed services, removing unnecessary internet access, enforcing strong authentication, tightening privilege, and watching for process or network behaviour that does not fit the workload.
Cloud and endpoint owners should also assume that mining abuse often follows ordinary compromise. If a system is exposed to the internet, runs with excessive privilege, or has long-lived secrets available, it can become a cheap and persistent source of compute for an attacker. GhostAction returns 2026 shows how stolen credentials and secret exposure can be reused across environments, including for cryptomining. GhostAction returns 2026 is a useful reminder that credential hygiene is part of stopping this abuse chain, not just a follow-on cleanup task.
Risk and Threat Considerations
Cryptomining botnets are attractive because they monetise access without immediately destroying the target, which often lets them stay hidden longer than noisy attacks. The main risk is not just compute theft, but the fact that the same foothold can be reused for credential theft, lateral movement, or additional malicious payloads.
Failure mechanism: An attacker gains execution on exposed or weakly protected systems, keeps persistence through a botnet control channel, and uses the host’s compute and network resources for mining while monitoring for opportunities to expand access.
Impact: Organisations can face degraded service, higher cloud or power costs, noisy incidents, and a broader compromise surface if the botnet is part of a larger intrusion chain.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Cryptomining botnets hijack system resources to generate cryptocurrency. |
| Recommendation — Map mining abuse to T1496 and hunt for sustained compute misuse plus linked persistence activity. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Exposed or weakly configured systems are a common entry point for botnet-driven mining abuse. |
| Recommendation — Harden exposed systems and remove unnecessary services to reduce botnet footholds. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Stolen or abused credentials often enable initial access and continued botnet control. |
| SI-4 — System Monitoring | Mining botnets are detected through anomalous process, network, and resource behaviour. | |
| AC-6 — Least Privilege | Overprivileged hosts and accounts make botnet persistence and lateral expansion easier. | |
| Recommendation — Rotate and tightly manage authenticators and secrets that could sustain botnet access. Monitor resource, process, and network anomalies to surface cryptomining abuse early. Apply least privilege to limit what a compromised host can access or alter. | ||
Practitioner Guidance
Why practitioners should care: Treat cryptomining botnet activity as an abuse signal, not a standalone nuisance. If one host is mining, the real question is how that host was reached and whether the same access still exists elsewhere.
What to watch for: Focus on resource spikes, suspicious outbound mining traffic, unknown persistence mechanisms, and repeated authentication or token anomalies across endpoints, servers, and cloud workloads.
Practitioner takeaway: Eradication is strongest when you remove the mining process, close the access path, and rotate any credentials or tokens that could have been used to establish or maintain control.
Related resources from NHI Mgmt Group
- What are the signs that a cryptomining botnet is evolving into a broader intrusion platform?
- How should security teams stop cryptomining attacks that use valid cloud credentials?
- Why do over-privileged cloud identities make cryptomining worse?
- Why do cloud native and AI workloads attract cryptomining malware?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org