What Is Cryptojacking and How to Detect and Remove It From Your Servers

Check CPU utilization for sustained high usage:

# Top processes by CPU usage: look for unrecognized processes above 80% CPU
top -bn1 | head -20

# More detailed: show command with arguments
ps aux --sort=-%cpu | head -20

# Check for processes sustaining high CPU for extended periods
sar -P ALL 1 5  # CPU utilization per core: mining pegs individual cores

Search for known mining process names:

# Common cryptominer process names
ps aux | grep -Ei '(xmrig|minergate|cpuminer|ethminer|t-rex|nbminer|gminer|lolminer|nanominer|phoenixminer|claymore)' | grep -v grep

# Search running processes for mining pool connection strings
ls -la /proc/*/exe 2>/dev/null | grep -Ei '(xmrig|miner|kswapd0|kdevtmpfsi)'

Check network connections to mining pools:

# Look for outbound connections to common mining pool ports (3333, 4444, 5555, 7777, 14433, 45700)
ss -tulpn | grep -E ':(3333|4444|5555|7777|14433|45700)'

# Check DNS resolutions for mining pool domains
ss -tulpn | awk '{print $5}' | grep -v '127.0.0.1\|0.0.0.0\|:::' | sort -u

# Check /etc/hosts for mining pool entries or crypto-related entries
cat /etc/hosts | grep -Ev '^#|^$|localhost|127.0.0.1|::1'

Search the filesystem for mining software:

# Find XMRig configuration files
find / -name 'config.json' -newer /etc/passwd 2>/dev/null | xargs grep -l 'pool\|wallet\|xmr\|monero' 2>/dev/null

# Find recently modified or created executables (attackers often drop miners in /tmp, /dev/shm, /var/tmp)
find /tmp /var/tmp /dev/shm /run -type f -executable 2>/dev/null

# Find world-writable executables
find / -type f -perm -o+w -name '*.sh' 2>/dev/null | head -20

Check persistence mechanisms (where attackers hide to survive reboots):

# Cron jobs: mining software often installs cron entries to restart after kill
crontab -l
sudo crontab -l  # Root crontab
ls -la /etc/cron* /var/spool/cron/*

# Systemd services: look for unusual service names
systemctl list-units --type=service | grep -v 'loaded active running'
cat /etc/systemd/system/*.service | grep -E '(ExecStart|WorkingDirectory)' | head -30

# /etc/rc.local or init.d scripts
cat /etc/rc.local 2>/dev/null
ls /etc/init.d/ | grep -v 'default\|README'

AWS GuardDuty: built-in cryptomining detection:

If GuardDuty is enabled (it should be: see the GuardDuty guide), it automatically detects cryptocurrency mining activity via:

• CryptoCurrency:EC2/BitcoinTool.B!DNS: DNS queries to cryptocurrency mining domains
• CryptoCurrency:EC2/BitcoinTool.B: network connections to cryptocurrency mining infrastructure
• Resource:EC2/PortProbeUnprotectedPort: attackers scanning for exploitable instances to deploy miners

# CLI: Check for GuardDuty cryptomining findings
aws guardduty list-findings \
  --detector-id $(aws guardduty list-detectors --query 'DetectorIds[0]' --output text) \
  --finding-criteria '{"Criterion": {"type": {"Equals": ["CryptoCurrency:EC2/BitcoinTool.B!DNS","CryptoCurrency:EC2/BitcoinTool.B"]}}}'

CloudWatch for CPU spikes:

# Find EC2 instances with sustained high CPU in the last 24 hours
aws cloudwatch get-metric-statistics \
  --namespace AWS/EC2 \
  --metric-name CPUUtilization \
  --dimensions Name=InstanceId,Value=INSTANCE-ID \
  --start-time $(date -u -d '24 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --end-time $(date -u +%Y-%m-%dT%H:%M:%SZ) \
  --period 3600 \
  --statistics Average \
  --output json | jq '.Datapoints[] | select(.Average > 80)'

AWS CloudTrail: detect how the attacker got in: Once a mining instance is identified, CloudTrail shows what API calls preceded the compromise: this tells you the initial access vector (stolen key, public bucket, exposed EC2 metadata service):

aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=ResourceName,AttributeValue=INSTANCE-ID \
  --start-time $(date -u -d '72 hours ago' +%Y-%m-%dT%H:%M:%SZ) \
  --output json | jq '.Events[] | {EventTime, EventName, Username, SourceIPAddress}'

Kubernetes clusters are high-value targets: thousands of CPUs controlled by a single credential compromise or misconfigured API server.

Check for suspicious pods with high resource consumption:

# List all pods with their CPU usage
kubectl top pods --all-namespaces | sort -k4 -rn | head -20

# Look for pods running privileged containers (attacker prerequisite for some mining setups)
kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.containers[].securityContext.privileged == true) | {name: .metadata.name, namespace: .metadata.namespace}'

# Check for pods using hostPID or hostNetwork (common in cryptomining malware)
kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.hostPID == true or .spec.hostNetwork == true) | {name: .metadata.name, namespace: .metadata.namespace}'

Check recent pod creation events:

# Recent events: look for pods created in unusual namespaces or with unusual names
kubectl get events --all-namespaces --sort-by='.lastTimestamp' | tail -50 | grep -i 'created\|started'

# Check for pods in default namespace (often used by attackers who compromise admin creds)
kubectl get pods -n default

Falco: runtime security for Kubernetes: Falco is an open-source runtime security tool that detects cryptomining-specific behaviors:

• Execution of xmrig or known miner binaries
• Outbound connections to known mining pool IPs
• Container spawning shells (attacker interaction)

# Install Falco via Helm
helm repo add falcosecurity https://falcosecurity.github.io/charts
helm install falco falcosecurity/falco --namespace falco --create-namespace

# Check Falco alerts
kubectl logs -n falco -l app=falco | grep -i 'miner\|xmrig\|crypto'

Do not just kill the process: find and remove persistence:

# 1. Kill the mining process
sudo kill -9 $(pgrep -f xmrig)

# 2. Remove persistence mechanisms
# Remove cron entries
crontab -r  # Root's crontab
sudo crontab -r

# Remove systemd service if installed
sudo systemctl stop miner.service
sudo systemctl disable miner.service
sudo rm /etc/systemd/system/miner.service
sudo systemctl daemon-reload

# 3. Delete the mining binary and config files
sudo rm -rf /tmp/xmrig /dev/shm/xmrig /var/tmp/kdevtmpfsi
sudo find / -name 'config.json' -newer /etc/passwd 2>/dev/null | xargs grep -l 'pool\|wallet' | xargs rm -f

# 4. Remove attacker-created user accounts
cat /etc/passwd | awk -F: '{if ($3 >= 1000 && $3 < 65534) print $1}'
# Review: delete any accounts not created by you
sudo userdel -r suspicioususer

# 5. Remove attacker SSH keys
cat ~/.ssh/authorized_keys  # Review for unauthorized keys
cat /root/.ssh/authorized_keys

After eradication:

1. Rotate all credentials that could have been compromised (IAM keys, SSH keys, service account passwords)
2. Identify the initial access vector (the attacker's entry point) and close it: if you do not close the entry point, re-infection is guaranteed
3. Review cloud spending for the affected period: many cloud providers will negotiate credits for cryptomining incidents when reported promptly
4. For AWS, open a Support case reporting the incident: AWS has an incident response team that can assist and may provide billing credits