Stratum Mining Protocol

How Stratum mining traffic works

Stratum is a purpose-built message pattern for cryptocurrency mining, not a general-purpose application protocol. A miner typically authenticates to a pool, receives work assignments, and returns shares that prove it is contributing hash effort. That predictable sequence makes Stratum useful both for mining operations and for defenders who want to recognise mining-related activity on a network.

Because the protocol is narrow in purpose, its traffic often stands out from ordinary enterprise communications. Even when the payload is not inspected deeply, the pattern of connection setup, work distribution and repetitive share submission can be enough to identify a miner, especially where outbound connections to unfamiliar endpoints or unusual ports accompany the flow.

Why defenders care about Stratum

Stratum is valuable to defenders because it creates a visible behavioural fingerprint. In environments where cryptominers appear unexpectedly, analysts can use that fingerprint to separate mining traffic from other encrypted or long-lived sessions, and to distinguish active mining from dormant software that only looks suspicious by filename or process name.

That matters because mining activity is often discovered after resource abuse has already begun. If defenders can recognise Stratum early, they can confirm whether a host is participating in a pool, estimate the scope of the activity, and decide whether the issue is isolated misuse of a single endpoint or evidence of broader compromise.

Traffic review should be paired with host-side telemetry. A miner may tunnel through legitimate tooling, run inside a container, or live alongside other malware, so network recognition alone is rarely sufficient to understand how it arrived or what else it did.

Common visibility and investigation cues

Investigators usually look for repeatable request and response timing, long-lived sessions, and a steady exchange of small jobs and share acknowledgements. Those patterns can be especially noticeable when they originate from servers, containers, or workstations that should have no mining role.

Correlating Stratum-like flows with DNS lookups, process creation, container activity, and cloud control-plane events helps separate benign pool access from compromise. In practice, the strongest signal is often the combination of network pattern, workload context, and unexpected compute consumption rather than any single packet alone.

For analysts, the key question is not just whether Stratum is present, but why a system is speaking it at all. On managed infrastructure, the answer often points to misconfiguration, exposed credentials, or an execution path that allowed unauthorised software to start mining.

Containment and remediation priorities

Once Stratum traffic is linked to an unauthorised miner, containment should focus on stopping the session, isolating the affected asset, and removing the mechanism that allowed the miner to run. That may mean terminating processes, cordoning a container or node, revoking access used to deploy the miner, and checking whether the traffic resumes from another host.

Remediation is stronger when it addresses the path of entry as well as the workload itself. If the mining activity came from exposed cloud credentials, a weakly protected host, or an abused management interface, those conditions need to be corrected or the miner will likely return. In environments with shared infrastructure, the investigation should also consider whether the same trust path exists elsewhere.

Where response is still in progress, analysts often use a structured incident approach for cryptomining events, especially when the traffic pattern suggests container, Kubernetes, or cloud exposure. NHIMG’s Cryptojacking Incident Response Playbook is a practical reference for containment, evidence preservation, and post-removal recovery.

Stratum in the wider mining threat picture

Stratum is not itself malware, but it is often the communications layer for mining abuse. That makes it useful in threat hunting, where defenders can map observed pool traffic to a larger abuse pattern involving initial access, compute hijacking, persistence, and cost impact. The protocol becomes especially important when it is seen alongside exposed credentials or cloud misconfiguration that enabled the mining operation.

In cloud environments, mining campaigns frequently rely on insecure control surfaces rather than on sophisticated exploit chains. A good example is NHIMG’s Tesla Kubernetes cryptojacking 2018, which illustrates how exposed credentials and weakly protected container infrastructure can turn into cryptocurrency mining activity.

For protocol discovery and standards context, the protocol ecosystem is often organised through registry and standards bodies such as IANA and IETF. Those references help explain why defenders often rely on stable protocol behaviour, not only payload signatures, when they classify suspicious traffic.

Related resources from NHI Mgmt Group

• What is the Model Context Protocol (MCP) and why does it matter for security?
• How should security teams govern AI agents that use Model Context Protocol?
• Why does Model Context Protocol create identity risk for enterprises?
• When does AI-driven role mining become a risk instead of a benefit?