Cryptojacking

Layer 7: Application Medium risk

How it works

Mining cryptocurrency requires a lot of computing power. Rather than paying for it, criminals install mining software on systems they have broken into, or run mining scripts in a visitor's browser through a compromised website. In the cloud, stolen access keys can be used to launch powerful servers that run up large bills in a short time. Miners are sometimes added to servers through unpatched web applications or exposed management interfaces.

Cryptojacking is often treated as a nuisance, but it means someone has gained unauthorized access. The same weakness that let a miner in, such as an unpatched server or leaked cloud credentials, could be used for data theft or ransomware. Symptoms are frequently mistaken for ageing hardware or ordinary performance problems, so infections can persist for months. Heavy, constant load can also shorten hardware life and increase electricity costs for on-premises equipment.

Warning signs

• Devices running hot, with fans constantly at high speed
• Sustained high processor usage when idle
• Unexpected spikes in cloud computing bills
• Unknown processes or scheduled tasks
• New cloud servers or regions you did not set up

How to defend against it

• Patch servers and web applications promptly
• Protect cloud accounts with MFA and set budget alerts
• Monitor device performance and unusual processes
• Use endpoint protection that detects mining tools
• Rotate and secure access keys and secrets

If it happens to you

1. Terminate the mining processes or unauthorized cloud resources
2. Find and close the original point of entry
3. Rotate credentials and keys that may be exposed
4. Contact your cloud provider about unexpected charges