Glossary · simply explained

Cryptojacking

Cryptojacking steals compute for crypto mining: no encryption, no alarm — just silent costs.

Cryptojacking is the covert abuse of other people’s computing power to mine cryptocurrencies: compromised servers, cloud instances or containers work for the attacker’s wallet — paid via your electricity and cloud bill.

The attack wants to stay undetected: no data theft, no extortion, no destruction. Exactly that makes it insidious — and a reliable indicator that someone has access to your environment who could use it differently tomorrow.

How cryptojacking enters environments

Preferred paths are unpatched, exposed services, compromised container images, open Kubernetes dashboards and leaked cloud credentials — miners can be rolled out automatically in minutes. In the cloud, attackers abuse stolen API keys to launch new, powerful instances themselves: the damage then appears on the bill, not on your own machines.

Detection works via behaviour: persistently high CPU or GPU load without business purpose, connections to mining pools, unexpected instance launches and cost jumps. Cloud cost alerts are an underrated security sensor here.

Warning signs and countermeasures

Base load rises gradually, systems become sluggish — without new workloads.
Cloud bill jumps: foreign-launched instances, unknown regions.
Egress filters block mining pool connections and render miners useless.
The real finding remains the access: find and close the entry point.

Frequently asked questions about Cryptojacking

Is cryptojacking dangerous or just annoying?

Both — the direct costs are annoying, the signal is serious: someone has code execution in your environment. The same access works for ransomware or data theft; miners are often just the first, lowest-risk monetisation. The incident deserves full investigation.

How do I detect cryptojacking in the cloud?

Via cost and behaviour anomalies: unexplained spending jumps, instances in never-used regions, maxed-out CPU on new resources, API calls of unusual origin. Budget alerts and the cloud provider’s anomaly detection are mandatory tools.

Why do miners often appear in Kubernetes environments?

Because automation meets attack surface there: open dashboards, overly generous service accounts, vulnerable images — and an orchestrator that scales at will. Whoever hijacks a cluster gets the mining data center for free.

Does egress filtering help against miners?

Yes, twice: without a connection to the mining pool the miner is worthless, and the blocked connection attempt is a clean detection signal. Outbound control is basic hygiene anyway — cryptojacking just adds another argument.

What to do after finding cryptojacking?

Do not just delete the miner: identify the entry point (vulnerability, credentials, image), search for persistence mechanisms and further backdoors, rotate credentials — and check what else the access touched. The miner is the symptom, not the problem.