The Rise of Cryptojacking
Cryptojacking — the unauthorized use of someone else's computing resources to mine cryptocurrency — has exploded in popularity among cybercriminals. Unlike ransomware, which relies on victims paying a ransom, cryptojacking generates revenue continuously and silently.
How Cryptojacking Works
Browser-Based Mining
The most common form uses JavaScript to mine cryptocurrency directly in the victim's browser:
- Coinhive (now defunct) popularized in-browser mining of Monero (XMR)
- Scripts are injected into compromised websites or served through malvertising
- Mining continues as long as the browser tab remains open
- CPU usage spikes to 80-100%
Malware-Based Mining
More sophisticated attacks install dedicated mining software:
- Delivered through traditional malware vectors (phishing, exploits, drive-by downloads)
- Persists across reboots via scheduled tasks, services, or registry modifications
- Often configured to limit CPU usage to avoid detection
- Popular miners: XMRig, XMR-Stak, CCMiner
Cloud Infrastructure Hijacking
Attackers target cloud environments for their computing power:
- Compromised AWS, Azure, or GCP credentials used to spin up mining instances
- Kubernetes clusters exploited for container-based mining
- CI/CD pipelines abused to run mining workloads
- Can result in enormous cloud bills for victims
Technical Analysis
Monero: The Cryptocurrency of Choice
Most cryptojacking operations mine Monero (XMR) because:
- CPU-friendly algorithm (RandomX): Profitable even on regular CPUs
- Privacy features: Transactions are untraceable by design
- No specialized hardware needed: Unlike Bitcoin, which requires ASICs
Mining Pool Communication
Miners connect to mining pools using the Stratum protocol:
{"id": 1, "method": "login", "params": {
"login": "wallet_address",
"pass": "x",
"agent": "XMRig/6.0"
}}
Persistence Mechanisms
Common persistence techniques observed in cryptojacking malware:
- Scheduled Tasks:
schtasks /create /tn "SystemUpdate" /tr "miner.exe" /sc onstart - WMI Event Subscriptions: Trigger mining on system events
- Service Installation: Register as a Windows service
- Rootkit Components: Hide the miner from process listings
Detection Methods
Performance Indicators
- Sustained high CPU usage (>80%) without visible cause
- Increased electricity consumption
- System overheating and fan noise
- Slow system performance
Network Indicators
- Connections to known mining pools (e.g.,
pool.minexmr.com,xmr.pool.minergate.com) - Stratum protocol traffic on unusual ports
- DNS queries for mining pool domains
Endpoint Detection
- Monitor for known mining executables (xmrig, ccminer, etc.)
- Detect process injection used by fileless miners
- Track CPU usage patterns over time
- Scan browser extensions for mining scripts
Prevention and Mitigation
Browser Protection
- Ad blockers: Block known mining scripts
- Browser extensions: NoCoin, MinerBlock
- Content Security Policy: Restrict JavaScript sources
- Anti-crypto mining features: Built into Opera and other browsers
Network Defense
- Block mining pool domains at DNS/proxy level
- Monitor for Stratum protocol traffic
- Implement egress filtering to block unauthorized connections
- Deploy IDS/IPS rules for mining traffic detection
Endpoint Security
- Keep systems patched to prevent exploitation
- Application whitelisting to block unknown executables
- Monitor CPU usage trends and alert on anomalies
- Scan for cryptojacking malware with updated signatures
- Implement EDR for behavioral detection
Cloud Security
- Enable billing alerts to detect unusual spending
- Monitor for unauthorized instance creation
- Secure API keys and credentials
- Audit IAM permissions regularly
- Implement container security scanning
Conclusion
Cryptojacking represents a shift in the cybercriminal economy from disruptive attacks to sustained revenue generation. While less dramatic than ransomware, the cumulative impact of cryptojacking can be significant. Organizations should implement comprehensive detection and prevention strategies that cover browser, network, endpoint, and cloud environments.