Cryptojacking in Cloud Environments

Common Entry Vectors

• Leaked/Hardcoded Credentials: Keys in code, CI/CD logs, public repos.

• Exposed Services: Open Docker/Kube APIs, SSH/RDP, weak IMDS settings.

• Unpatched Apps & Images: CVE exploits, malicious base images.

• Over-Permissive IAM: Broad roles enabling unfettered instance or pod creation.

How to Identify

• Metrics: Sustained high CPU/GPU; sudden ASG scale-outs; abnormal spot usage.

• Network: Outbound to mining pools, DNS to known pools.

• Host/Container: Unknown binaries, cron jobs, systemd timers.

• Cloud Logs/Findings: Unusual region provisioning, disabled logging/EDR; crypto-mining alerts from cloud security tools.

Immediate Response (Contain & Eradicate)

• Isolate & Snapshot: Quarantine instances/pods, capture images for forensics.

• Block Egress: Temporarily block pool domains/IPs, restrict internet egress.

• Rotate Secrets: Revoke access keys, tokens, kubeconfigs; invalidate session tokens.

• Remove Persistence: Kill processes, delete cron/systemd tasks and deploy from trusted images.

• Patch & Review: Fix exploited services; check lateral movement and cloud activity.

• Secrets Hygiene: Use short-lived creds, IAM roles/managed identities, secret managers; eliminate hardcoded keys.

Conclusion

Treat cryptojacking as both cost fraud and security breach. Pair strict identity controls with hardened compute, tight egress, continuous monitoring, and automated containment.