Overview
A miner is rarely the primary payload; it is monetising an existing foothold while the operator decides what else to do.\nThe visible symptoms are pegged CPUs, thermal throttling, cloud bills that double, and cooling fans running at full speed.\nContainers and CI runners are frequent targets because they are already under-patched and rarely monitored.
Indicators of Compromise
Signals that suggest this is present on a system.
- Sustained CPU load with no business process behind it
- Connections to mining pools on non-standard ports
- Unexpected processes in containers or build agents