Cryptojacking - how to recognise if the processor is being used for cryp­tocur­rency mining?

What is cryp­to­jack­ing, and why should it trigger in­ci­dent response?

A cryptocurrency miner launched without the owner's consent consumes processor, memory, energy, licences and cloud resources. More importantly, the mere presence of a miner usually indicates a previous breach: clicking on a fake link, a vulnerable application, a compromised password, an open admin panel, or a lack of updates. Therefore, it is not enough to delete the process. You need to find the entry vector, the scope of the breach and the persistence mechanism.

• High CPU usage without a business reason is a signal, not proof.
• The miner can run in a browser, a system process, a container, a web server, or a virtual machine.
• The incident requires checking passwords, updates, logs, firewall rules and administrative accounts.
• In a cloud environment, there are also risks of uncontrolled costs and new instances launched by a compromised account.

Why cryptojacking is still making a comeback in corporate environments

Cryptojacking is attractive to attackers because it can work more silently than ransomware: it does not always block the company immediately, but constantly consumes resources and hides the fact of a previous hack. Most often, it exploits gaps in system maintenance: an outdated CMS, a panel exposed to the Internet, an account without MFA, a weak password or no cloud cost limits. An increase in CPU, GPU or cloud resource load should therefore trigger security diagnostics, not just a performance report.

• Check if the load occurs outside of business hours or after implementing changes to the application.
• Compare your cloud processes, network connections and costs with your typical system performance profile.
• Determine if similar symptoms occur on other hosts, containers, or virtual machines.

Symptoms that should trigger diagnostics

The user most often sees slowdowns, loud fans, heating of the device and reduced battery life. An administrator should look at the bigger picture: processes with unusual names, connections to known mining pools, recurring tasks, new local accounts, PowerShell scripts, cron entries, out-of-hours workload, and sudden increases in cloud costs. In practice, what matters is the comparison to the host's normal operating profile, because a single CPU spike can be a legitimate task, and a constant pattern with external connections requires isolation.

A practical response map for suspected cryptojacking

If cryptojacking is suspected, assess service impact and promptly contain active abuse, for example through authorised host isolation or blocking a compromised identity. Preserve logs in parallel where safe. Establish scope and entry method; removing the process alone may leave persistence. This description is not a Virtline response-time commitment or contractual SLA.

• Collect a list of hosts with unusual CPU, RAM, network traffic, and cloud costs.
• Secure EDR logs, firewall, DNS, proxy, web servers and identity systems.
• Contain active abuse through authorised host isolation. For production and OT, agree operational impact with the process owner; preserve available volatile evidence and do not shut devices down automatically.
• Check whether the infection is coming back via a recurring task, startup script or a vulnerable application.

How to protect yourself from cryp­to­jack­ing? – op­er­at­ing system ver­i­fi­ca­tion and updates

The basis of protection is regular verification of systems, updates and vulnerable applications. Miners often enter the environment through an outdated CMS, a vulnerable web server, a weak admin password, a public panel, or a workstation without script control.

Techniques used

The attack could use JavaScript in the browser, a malicious system process, a PowerShell script, a container, cron, a scheduler task, a vulnerable CMS plugin, or a compromised cloud account. Technique matters because it determines how to isolate the host, preserve evidence, and close the entry vector.

• Browser scripts and fake extensions that burden the user's CPU.
• Malware launched from a user profile, temporary directory or recurring task.
• Miners in containers, virtual machines or poorly secured public services.
• Cloud use via compromised API keys, administrator account or integration without cost limits.

How to increase system security to protect against cryptojacking?

Sustainable improvement requires a combination of hardening, monitoring and education. Simply blocking a known mining domain is not enough if the environment still has a vulnerable panel, no MFA, no EDR and no log correlation.

• Deploy EDR, alerts on CPU, DNS, processes, outbound connections and cloud costs.
• Close public admin panels or secure them with MFA, VPN and whitelisting.
• Update systems, applications, CMS, plugins, container images and dependencies.
• Train users on phishing, fake links and reporting unusual device behaviour.

Phased action plan after the incident

During response, restrict attacker access, invalidate compromised sessions and credentials, remove persistence and close the entry vector before safely restoring the service. If a patch requires a maintenance window, apply temporary restrictions and monitor the exposure. Monitoring and recovery verification start during incident handling. The dates below are example reviews of post-incident improvements, not deadlines for starting the response.

How to reduce the risk of repeated compute abuse

Effective protection combines updates, EDR, browser control, DNS filtering, privilege restriction and user awareness. Vulnerability management is also important in companies: miners often appear where a web application, CMS, plug-in or administration server has not been updated for many months.

• Block unknown scripts and browser extensions from running.
• Keep your systems, CMS, plugins, containers and machine images up to date.
• Monitor unusual outgoing connections and cryptocurrency mining domains.
• Restrict the rights of local administrator and service accounts.

A quick checklist for the administrator

If you suspect cryptojacking, start with facts that can be confirmed in the logs. A good checklist helps you avoid two mistakes: deleting evidence before analysis and treating every CPU spike as an attack.

• Compare host load against monitoring history and a calendar of legitimate tasks such as backup, indexing or reporting.
• Check the process command line, parent process, user, file signature, disk location and run time.
• Verify DNS, outgoing connections, domain reputation, firewall rules and possible connections to mining pools.
• Determine whether the symptom affects a single endpoint, multiple hosts, a container, a web server, or a cloud resource.
• Check cloud cost limits, new instances, API keys and privileged accounts when cloud resources are affected.
• Write down your hypothesis and evidence before cleaning the host so you can close down the cause, not just the symptom.

What should the company receive after analysing the incident?

Initial assessment of suspected cryptojacking should give the IT team and management clear answers: whether it is a single host, a broader compromise, a configuration error, or a symptom of a vulnerable application. Deliverables must be specific enough that administrators can address the cause and decision makers understand the impact on costs, business continuity and data risk. A good report separates log-confirmed facts from hypotheses and indicates which controls need to be implemented immediately and which should be planned in the following weeks.

• Event timeline with processes, accounts, IP addresses, domains and log sources.
• List of infected or suspicious hosts, accounts, containers and cloud resources.
• Entry vector and persistence mechanism: recurring task, script, vulnerability, account or integration.
• Recovery plan including EDR, updates, MFA, SIEM rules, DNS and cloud cost monitoring.

Related services and articles

Cryptojacking should be treated as a test of the environment's visibility. If a company can't quickly pinpoint stressed hosts, processes, accounts, and network connections, it needs better EDR, monitoring, and incident procedures.

Cryptojacking in 2026 - when to escalate beyond performance support

Suspected mining becomes a security incident when the company cannot explain the workload through normal operations or when the same pattern appears in endpoints, servers, containers or cloud costs. Escalation should be based on operational impact and evidence quality, not only on how slow one workstation feels.

• Endpoint: compare the process command line, parent process, file signature, path and user with the expected EDR configuration and behaviour. Escalate if the host can access customer data, administrator credentials or production systems.
• Web server: inspect application logs, new files, cron and scheduled tasks, service accounts and vulnerable plugins. Involve application owners if a CMS, plugin, container image or public administration panel may be the source.
• Cloud: review new instances, API keys, unusual regions, cost limits and accounts without MFA. Involve finance when unexpected cloud costs appear.
• Network: check DNS, proxy and firewall logs, domain reputation and connections to mining pools.
• Decision: if logs cannot establish the extent of the incident, move from an immediate fix to an EDR/SIEM review. Involve management when incomplete evidence may indicate a wider compromise.

CPU, GPU and cloud abuse: the business impact

Cryptojacking can run for a long time without a visible outage while the company pays for compute and cloud resources. Technical findings therefore need to inform decisions about costs, service availability and lasting safeguards.

• Treat compute abuse as a cost, availability and security signal, not only a workstation problem.
• Add cloud budgets, cost alerts and owner reviews to the same process as EDR and SIEM alerts.
• Use the incident to close root causes such as weak passwords, exposed panels and missing update ownership.
• Decide which controls become permanent: MFA, EDR, log retention, cost monitoring and vulnerability management.

Security follow-up after cryptojacking

A short consultation identifies which logs to preserve first, which hosts to isolate and which controls to prioritise after the incident.