Cryptominer.

A cryptominer uses computing power to solve the proof-of-work puzzles that secure a cryptocurrency, earning block rewards. Legitimate miners are installed by the owner; malicious cryptominers are dropped by malware or injected into web pages and run hidden, stealing electricity and compute — abuse known as cryptojacking. Attackers overwhelmingly target Monero (XMR) using the open-source XMRig miner, because Monero's RandomX algorithm is CPU-friendly and its ring signatures frustrate payment tracing.

Real campaigns show the scale. In February 2018 RedLock found that intruders had reached Tesla's unauthenticated Kubernetes administration console, obtained AWS credentials, and quietly ran mining pods using evasion techniques — the pool hidden behind CloudFlare and CPU throttled to avoid detection. In October 2019 Palo Alto Unit 42 documented Graboid, the first cryptojacking worm to spread through unsecured Docker daemons, infecting roughly 2,000 hosts and mining Monero in bursts. Families such as Kinsing and WannaMine (which reused the EternalBlue exploit) show how miners piggyback on exposed cloud services and unpatched hosts.

Indicators include sustained high CPU/GPU load, short-lived child processes, and outbound connections to Stratum mining pools. Because most endpoint tools do not inspect inside containers, cloud and Kubernetes workloads need dedicated monitoring. Defences: remove default-exposed admin consoles, block mining-pool domains and Stratum ports, application allow-listing, and cost/utilisation anomaly alerts that flag unexpected compute growth.

flowchart TD
  A[Exposed Docker/K8s API or unpatched host] --> B[Attacker drops XMRig payload]
  B --> C[Miner runs hidden with throttled CPU]
  C --> D[Connects to Stratum mining pool]
  D --> E[Monero XMR sent to attacker wallet]
  C --> F[Worm scans for next victim]
  F --> A