Cryptomining is the process of using computing power to solve the cryptographic work required to validate transactions and create new cryptocurrency units. In practice, miners repeatedly generate hashes until one meets the coin’s difficulty requirement. The work is computationally expensive, which is why attackers seek out other people’s machines.
What cryptomining means in practice
Cryptomining is computational work, not a data query or a normal business workload. The defining feature is that the machine keeps performing hash calculations until one satisfies the network’s difficulty target, so the cost is measured in CPU, GPU, power, and heat. That makes the activity useful to legitimate miners and attractive to abuse on someone else’s infrastructure.
Because mining is intentionally resource-intensive, the practical boundary between “expected compute use” and “abusive use” matters. A system can be overworked by a browser script, a container, a VM, or a cloud workload, but the security significance is the same: the attacker is converting your capacity into their revenue.
Why attackers target other people’s machines
The main reason cryptomining appears in security discussions is economic. An attacker avoids the capital expense of hardware and electricity by hijacking someone else’s compute. That can happen on endpoints, servers, cloud instances, developer workstations, Kubernetes nodes, or exposed AI infrastructure. NHIMG’s Storm-1283 OAuth apps abuse 2023 and ShadowRay 2024 both show how stolen access can be turned into cloud compute abuse, including cryptomining.
Cryptomining is also often a persistence-friendly activity. It can run quietly, blend into legitimate load, and continue long after initial compromise if the attacker has not been removed from the environment. In some cases the mining payload is only the visible symptom of a broader intrusion that also involves credential theft, exposed secrets, or unauthorized cloud access.
How cryptomining affects systems and operations
Mining consumes throughput that legitimate users and services need. That can show up as CPU saturation, GPU contention, memory pressure, elevated cloud bills, slower builds, degraded application response, and shortened hardware life. In shared environments, one compromised tenant or workload can create noisy-neighbour effects that spread operational pain beyond the initial host.
The business impact is not limited to resource cost. Heavy compute use can trigger autoscaling, capacity exhaustion, service instability, alert fatigue, and incident response effort. Where mining runs inside containers or orchestration platforms, it may also indicate weak workload isolation, permissive runtime permissions, or missing controls on who can launch compute-intensive jobs.
How organisations identify and reduce exposure
Exposure is usually found by combining asset inventory, cloud visibility, and telemetry on unusual resource consumption. Look for hosts or workloads that suddenly sustain high CPU or GPU usage, unexpected outbound traffic to mining pools, new scheduled tasks or containers, and internet-facing services that should not be able to spawn arbitrary compute jobs. Vendor advisories and CISA KEV entries help when the mining path depends on a known exploited vulnerability, but the operational question is always the same: where can unauthorised compute be started, and by what path?
Defence is strongest when organisations reduce the number of places where hostile code can execute, limit standing access to cloud and dev platforms, and monitor for anomalous workload creation. If mining is successful, the underlying access path often deserves more attention than the miner itself.
What cryptomining can reveal about compromise
Cryptomining is often a detection clue rather than the only objective. A miner may be dropped after initial access to monetise the compromise quickly, or it may run alongside credential theft, lateral movement, or cloud abuse. That means the incident response question is not just “how do we stop the miner?” but “what else did the attacker reach while they were here?”
Post-incident review should include any credentials, API keys, sessions, or service accounts that enabled the abuse, especially if the mining occurred in cloud or automation contexts. If those access paths remain valid, the same actor may be able to return and reuse them for other forms of abuse.
Risk and Threat Considerations
Cryptomining is a direct abuse of authorised compute, so the risk is both operational and adversarial. It can drain resources silently, inflate cloud spend, and indicate that an attacker has already obtained execution on a host, cluster, or cloud account.
Failure mechanism: Attackers gain code execution or cloud access, then schedule or deploy mining processes that persist, consume capacity, and hide within normal resource noise.
Impact: The organisation loses compute, money, and stability, and the same foothold can be reused for deeper compromise, credential abuse, or broader infrastructure takeover.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1496 — Resource Hijacking | Cryptomining is a classic form of resource hijacking. |
| Recommendation — Hunt for resource hijacking and correlate unusual compute consumption with malware execution. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Mining malware is a common endpoint and server abuse pattern. |
| Recommendation — Detect and block mining payloads with malware defenses and executable control. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and Network Services Monitored to Find Events | Mining often shows up as abnormal network and resource behaviour. |
| Recommendation — Monitor network and workload telemetry for anomalous compute or outbound mining activity. | ||
| NIST SP 800-53 Rev 5 | SI-4 — System Monitoring | Cryptomining is identified through continuous monitoring and anomaly detection. |
| Recommendation — Use system monitoring to detect abnormal resource use, persistence, and mining traffic. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | Mining in cloud or automation contexts often follows exposed credentials or tokens. |
| Recommendation — Rotate leaked secrets and revoke exposed credentials that enabled mining abuse. | ||
Practitioner Guidance
Why practitioners should care: Treat cryptomining as a security signal, not just a cost issue. When mining appears, it usually means some combination of exposed workload, weak access control, or compromised credentials has already been exploited.
What to watch for: Sustained high utilisation without a matching business workload, new outbound traffic to mining infrastructure, and cryptomining activity that reappears after deletion are all signs that the underlying access path is still open.
Practitioner takeaway: Remove the miner, then verify how it got in, what access it used, and whether any secrets or sessions need to be rotated before normal service is restored.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org