Cryptomining trojan

Expanded Definition

A cryptomining trojan is a form of malware that covertly turns victim infrastructure into an unauthorised mining workload, usually by installing a miner, maintaining persistence, and suppressing visible performance impact. Its defining feature is not data exfiltration but the covert diversion of compute, power, and cloud spend for attacker gain. In practice, it often blends commodity malware tradecraft with simple command-and-control behaviour, making it easier to deploy at scale and harder to notice until resource consumption trends become abnormal.

Within cybersecurity, the term is best understood as a workload abuse problem as much as a malware problem. The NIST Cybersecurity Framework 2.0 is useful here because it frames the need to identify assets, protect workloads, detect anomalies, and recover from compromise. Definitions vary across vendors on whether a browser-based miner, a trojanised installer, or a cloud instance hijack all qualify under the same label, so the safest interpretation is behavioural rather than packaging-based. The most common misapplication is calling any CPU spike a cryptomining trojan, which occurs when teams skip validation of persistence, mining pools, or suspicious process lineage.

Examples and Use Cases

Implementing detection for cryptomining trojans rigorously often introduces a tuning burden, requiring organisations to weigh alert fidelity against the risk of missing low-and-slow abuse.

• A workstation runs a hidden miner after a user opens a trojanised installer, and the malware re-launches through startup persistence after reboot.
• A compromised Linux server begins connecting to public mining pools, while endpoint tools show sustained CPU usage and unusual child processes.
• A cloud workload is hijacked through exposed credentials, and the attacker mines from a container until spend spikes and autoscaling hides the abuse.
• An infected VDI environment degrades user experience because the miner throttles itself during business hours and increases activity overnight.
• A security team correlates mining traffic with suspicious scheduled tasks and outbound connections, then uses guidance from MITRE ATT&CK to map persistence and command-and-control behaviours associated with the intrusion chain.

These examples show why cryptomining trojans can appear operationally “quiet” while still consuming meaningful resources and creating a foothold for follow-on activity. Security teams also use detection engineering and process tree review to separate legitimate compute workloads from malicious ones, especially in environments where mining-like behaviour can be mistaken for batch jobs or analytics pipelines.

Why It Matters for Security Teams

Cryptomining trojans matter because they turn security incidents into cost incidents, availability incidents, and governance incidents at the same time. They can mask deeper compromise, exhaust endpoint and cloud capacity, and create noisy telemetry that distracts analysts from higher-risk threats. In environments with strong identity controls, they often expose a different failure mode: stolen credentials, weak privilege boundaries, or unmanaged software installation paths that let attackers persist long enough to monetise access. For that reason, the term intersects with identity security whenever a miner is delivered through compromised accounts, abused service principals, or exposed secrets.

From a control perspective, defensive teams should align telemetry, asset ownership, and containment workflows so that abnormal resource usage triggers investigation rather than blame on “performance issues.” That operational pattern matches the broader intent of CISA guidance on disruption-aware response and hardening, even when the immediate payload is not ransomware. Organisations also benefit from tracking how miner deployments enter through OWASP guidance on abuse pathways when AI-assisted tooling or automated code generation introduces risky dependencies, although the specifics depend on the environment. Organisations typically encounter the full impact only after cloud bills, user complaints, or endpoint slowdowns force investigation, at which point cryptomining trojans become operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How should security teams stop cryptomining attacks that use valid cloud credentials?
• Why do over-privileged cloud identities make cryptomining worse?
• Why do cloud native and AI workloads attract cryptomining malware?
• Who is accountable when workload access leads to cryptomining abuse?