Detecting Cryptomining on Exposed Servers: Signals and Blind Spots
Cryptominers often hide in plain sight by mimicking legitimate system processes, requiring analysts to look beyond CPU spikes to network patterns and file integrity changes.
Detect cryptomining by monitoring for sustained high CPU usage on non-interactive servers, unusual outbound connections to known mining pools, and unexpected process spawning. Check for new user accounts, modified cron jobs, and discrepancies between running processes and installed binaries to identify hidden resource theft.
Process Anomalies and Resource Usage
High CPU utilisation is the most visible sign of cryptomining, but it is rarely the first indicator. Attackers often throttle their processes to avoid detection, keeping resource usage just below alert thresholds. You must look for sustained, consistent load rather than transient spikes. A web server experiencing periodic spikes during business hours is normal.
Check for processes with generic names that do not match known applications. Attackers frequently rename mining binaries to resemble system utilities. Look for discrepancies between the process name and the actual binary path. A process named systemd-update running from a temporary directory is a red flag. Verify the parent-child relationship of these processes. Mining software often spawns from shell sessions or web server processes that should not execute arbitrary code.
| Signal | Where to look | What it may mean |
|---|---|---|
| Sustained high CPU | System metrics, top, htop | Active mining or resource theft |
| Unknown outbound connections | Netstat, ss, firewall logs | Communication with mining pools |
| New user accounts | /etc/passwd, useradd logs | Persistence mechanism for access |
| Modified cron jobs | /var/spool/cron, crontab -l | Scheduled re-infection or maintenance |
Network Traffic Patterns
Cryptominers must communicate with mining pools to submit work and receive rewards. This communication generates distinct network patterns. You will see long-lived connections to specific IP addresses or domains. These connections often persist even when the server has no legitimate business need to talk to the internet. Check for outbound traffic on non-standard ports. While many pools use standard HTTP or HTTPS ports, others use custom ports to evade simple firewall rules.
DNS queries provide another layer of evidence. Look for queries to domains that do not resolve to known services. Attackers often use domain generation algorithms or fast-flux networks to host their pools. This makes the destination IP change frequently. If your server suddenly starts resolving thousands of unique domains, investigate the source process. This behaviour indicates a command-and-control channel or a mining pool discovery mechanism.
File System and Integrity Changes
Attackers need to install their tools on your server. This leaves traces in the file system. Look for new executable files in unexpected directories. Attackers often place binaries in /tmp, /var/tmp, or user home directories. These locations are writable by many users and are frequently overlooked in standard monitoring. Check for changes to system binaries. Attackers may replace legitimate utilities with backdoored versions to maintain access.
File integrity monitoring is critical here. Compare current file hashes against a known good baseline. Any change to critical system files warrants immediate investigation. Look for hidden files. Linux systems allow filenames starting with a dot to be hidden from standard directory listings. Use commands that show all files to detect these hidden scripts or binaries. Also check for modified configuration files. Attackers often edit SSH configurations to allow password authentication or add new authorized keys.
Persistence Mechanisms
A cryptomining attack is not a one-time event. Attackers install persistence mechanisms to ensure their software survives reboots and process kills. Cron jobs are a common method. Check for new entries in system and user crontabs. Look for jobs that run frequently, such as every minute or every five minutes. These jobs often execute scripts that download and launch the mining software.
Systemd services offer another persistence vector. Attackers create new service files that start automatically on boot. Check for services with generic names that are not part of your standard deployment. Verify the service files against your configuration management records. If a service exists on the server but not in your version control, it is likely malicious. Also check for entries in /etc/rc.local or other startup scripts. These legacy methods are less common but still used by older attack kits.
User and Authentication Logs
Access to the server is required to install cryptominers. Attackers often create new user accounts to manage their access. Check for new users added to the system. Look for accounts with sudo privileges or shell access that you did not create. Authentication logs reveal failed login attempts followed by successful ones. This pattern indicates brute-force attacks. If you see a successful login from an unusual IP address or at an unusual time, investigate the session.
Common Blind Spots
Several areas are frequently missed during cryptomining investigations. One blind spot is containerised environments. Attackers often compromise a container and use it to mine cryptocurrency. The host system may show normal resource usage, while the container consumes significant CPU. You must monitor container metrics separately from host metrics. Another blind spot is shared hosting environments. A compromised site on a shared server can affect other sites. Isolate resources to prevent lateral movement.
Tools for Detection
Standard operating system tools are sufficient for initial detection. Use top or htop to identify high CPU processes. Use ps to inspect process trees and arguments. Use netstat or ss to check active network connections. For deeper analysis, use file integrity monitoring tools. These tools track changes to critical files and alert you when modifications occur. Intrusion detection systems can also help. Configure them to alert on known mining pool IP addresses and domains.
Automated response tools can help contain the threat. Isolate the compromised server from the network to prevent further damage. Preserve logs for forensic analysis. Do not delete the malicious files immediately. You need them to understand the attack vector and improve your defences. Review your incident response plans to ensure you have a clear procedure for handling these events.
Prevention and Hardening
Prevention is more effective than detection. Minimise the attack surface by closing unnecessary ports. Use firewalls to restrict inbound and outbound traffic to only what is required. Disable password authentication for SSH. Use key-based authentication instead. This prevents brute-force attacks. Keep software up to date. Many cryptomining attacks exploit known vulnerabilities in web servers and application frameworks. Regular patching reduces the risk of exploitation.
Monitor for unusual behaviour continuously. Set up alerts for sustained high CPU usage, new user accounts, and modified system files. Review these alerts regularly. Do not ignore them. Early detection limits the damage and reduces the cost of remediation. Consider the insights from our guide on insider threats when investigating user behaviour, as compromised credentials can mimic internal actions. Also, review email authentication practices, as phishing remains a primary vector for initial access that leads to server compromise.
Key takeaways
- Resource exhaustion is a symptom, not the root cause; focus on the persistence mechanisms that allow miners to survive reboots.
- Network traffic analysis reveals connections to mining pools that endpoint logs might miss if the attacker uses legitimate DNS resolution.
- File integrity monitoring catches binary replacements that standard antivirus solutions often overlook due to lack of signature updates.
Cryptomining leaves distinct traces in process, network, and file system data that standard monitoring often misses. Implement continuous integrity monitoring and correlate resource usage with network activity to detect hidden miners early.
Frequently asked questions
How do I distinguish between a legitimate backup job and cryptomining?
Legitimate jobs are scheduled, have known parent processes, and connect to known backup servers. Cryptominers run continuously, have unknown parents, and connect to external mining pools.
Can cryptominers hide from standard process lists?
Yes, they can use rootkits to hide processes and network connections. File integrity monitoring and behavioural analysis are more effective than simple process listing.
What is the impact of cryptomining on server performance?
It consumes CPU and network resources, leading to slower response times, increased electricity costs, and potential service outages for legitimate users.
How do attackers gain initial access to install cryptominers?
They exploit unpatched vulnerabilities, use weak passwords, or leverage misconfigured services. See our guide on **zero-click attacks** for examples of exploitation without user interaction, though most mining requires some initial access.
How this guide was produced: written by the Malware Brief editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
