Cryptojacking & Unauthorized Miners

Threat Landscape & Operational Overview

Cryptomining malware (cryptojackers) covertly hijacks victim CPU, GPU, and memory resources to mine privacy-focused cryptocurrencies (primarily Monero / XMRig variants) for cybercriminal profit. While less destructive than ransomware, cryptojackers cause severe system degradation, excessive electrical consumption, hardware overheating, and critical cloud infrastructure billing inflation. Furthermore, the presence of a miner indicates a severe underlying access vulnerability—meaning the host is susceptible to secondary, high-severity payloads.

Primary MITRE ATT&CK Tactics & Techniques

Observed technical tradecraft, privilege escalation, and persistence patterns mapped across threat families in this category:

Actively Weaponized Exploits & Vulnerabilities (2 CVEs)

Adversaries deploying cryptojacking & unauthorized miners frequently weaponize the following software vulnerabilities for initial ingress, privilege escalation, or lateral movement:

SOC Incident Containment Checklist

Standard operating triage procedure for security teams responding to suspicious or confirmed infections in this category:

1. Identify processes consuming anomalous CPU/GPU utilization (90%+ sustained usage).
2. Block outbound network traffic to known Stratum mining pools and cryptocurrency proxy endpoints.
3. Audit scheduled tasks and cron jobs for recurring downloader scripts.
4. Determine the initial compromise vector (e.g. unpatched Apache Struts, exposed Docker API, weak SSH password).
5. Terminate malicious mining services and inspect system for secondary backdoor implants.

Prominent Malware Families in this Category

Top documented threats ranked by historical prevalence and behavioral signatures:

Complete Directory (5 Families)

Alphabetical index of all tracked malware families cataloged under cryptojacking & unauthorized miners:

• coins
• maener
• neksminer
• tiggre
• xmrig