Remediating a cryptojacking infection without affecting production
Cryptojacking is the unauthorised use of an organisation’s computers, cloud accounts or containers to mine cryptocurrency. A compromised workload may keep running its intended application while quietly consuming CPU, memory, electricity and cloud quota. That combination makes the incident easy to miss and risky to handle: an aggressive response can interrupt a customer portal, warehouse system, hospital service or mining operation that the business depends on.
A safe remediation process aims to remove the attacker’s persistence while preserving availability, evidence and operational control. For Australian enterprises, this means coordinating security, infrastructure, application owners and managed service providers across time zones, documenting decisions for governance purposes, and considering obligations under the Privacy Act 1988 and the Security of Critical Infrastructure Act 2018 where applicable.
What cryptojacking looks like in production
The first signs are often performance anomalies rather than a clear malware alert. A server may show sustained CPU utilisation, unusual fan activity, slower batch jobs, higher cloud expenditure or unexplained latency. In Kubernetes, a newly created pod, an unfamiliar image or a workload requesting excessive resources can indicate a mining process. On endpoints, defenders may find a suspicious executable, scheduled task, shell script or browser-based miner.
Network telemetry can provide stronger evidence. Mining software commonly communicates with a pool, wallet service or command-and-control host using Stratum or an encrypted web connection. Look for persistent outbound connections from systems that should have limited internet access, DNS requests for newly registered domains, unusual traffic from a build server, or a cloud workload contacting an external pool shortly after a credential change.
Australian organisations should compare these indicators with local operating patterns. A retailer’s Sydney or Melbourne e-commerce platform may experience predictable evening peaks, while a Brisbane-based logistics operation may run overnight processing. An unexplained CPU increase during a normal demand window is less meaningful than the same increase during a quiet period. Baselines must reflect seasonal sales, end-of-month finance runs and maintenance windows.
Why containment must be measured
The fastest-looking action is rarely the safest. Rebooting every suspected server, blocking all outbound traffic or deleting a compromised virtual machine can remove the miner, but it may also destroy volatile evidence, break integrations and create a second incident. Production containment should reduce the attacker’s options while keeping the business service available.
Begin by identifying the affected asset, its business owner, dependency map and recovery status. If the miner is running on a non-critical development instance, quarantine may be immediate. If it is inside a customer-facing application, use a controlled response: remove the host from the load balancer, shift traffic to healthy capacity, preserve a disk snapshot, then isolate the affected instance. In a container platform, scale a clean deployment rather than terminating every replica at once.
Network controls should be specific and reversible. Block confirmed mining pool addresses, domains and protocols at the egress layer, while allowing required payment, monitoring, software update and partner connections. Apply the change to the compromised host, workload identity or security group rather than the entire network. Record the rule, owner, timestamp and rollback method so an incident commander can assess its effect.
Build an evidence-led response
Before removing suspicious files, capture the facts needed to understand entry, scope and persistence. Collect process lists, command lines, parent-child relationships, network connections, DNS history, authentication events, cloud audit logs and relevant endpoint telemetry. A memory capture can help identify injected processes or credentials, although it should be performed by trained responders because collection can affect system performance.
The investigation should answer several practical questions: how did the attacker gain access, which account or secret was abused, when did mining begin, and did the intruder access sensitive information? Cryptojacking is sometimes treated as a low-impact nuisance, yet the miner may be a visible part of a wider compromise. Attackers can use the same foothold to deploy ransomware, steal credentials or move towards a domain controller.
Centralised records are valuable when multiple parties are involved. An Australian business may use a local managed security service provider, an overseas cloud team and an internal infrastructure group in different shifts. Preserve logs in a tamper-resistant location, use Australian Eastern or Central time consistently in the incident record, and maintain a clear chain of custody. Teams can use incident response documents to support repeatable evidence collection and coordinated remediation.
Remove the miner and close access
Eradication starts with the persistence mechanism, not just the visible mining binary. Review cron jobs, systemd services, Windows scheduled tasks, startup folders, registry run keys, container manifests, CI/CD pipelines, cloud-init scripts and orchestration secrets. Remove unauthorised images and packages, but retain hashes and copies in a secure evidence repository before deletion.
Credentials require particular attention. Reset compromised administrator, service and cloud access keys from a trusted device, revoke active sessions, rotate secrets in pipelines and review newly created accounts. Where possible, move workloads to short-lived identities with least-privilege permissions. An attacker who loses the original miner but keeps a valid cloud token can simply return after the cleanup.
Rebuild is safer than attempting to make a deeply compromised host trustworthy. Use a known-good image, apply current patches, restore only required configuration and scan the result before reconnecting it. For a containerised service, redeploy from a verified image digest and inspect the registry, deployment controller and admission policies. For a physical or virtual server supporting a critical application, coordinate a failover or maintenance window rather than forcing an unplanned outage.
Restore capacity and verify business services
Recovery is complete only when both the security condition and the production condition are acceptable. Watch CPU, memory, disk, network throughput, application latency, queue depth and error rates after reconnection. Check that customer transactions, payment processing, identity federation, backups and monitoring work as expected. A quiet process list does not prove that the business service has returned to normal.
Compare cloud billing and energy consumption with the baseline from before the incident. Mining activity can continue through a hidden account, a second region or a forgotten autoscaling group. Review all subscriptions, projects, resource groups and container clusters, including environments managed by a third party. This is especially important for Australian organisations using multiple public cloud regions to serve customers across Perth, Adelaide, Sydney and Melbourne.
Detection rules should remain heightened for several days. Alert on mining protocols, sudden resource exhaustion, unusual image pulls, new privileged roles and egress from restricted workloads. Test that alerts reach an on-call person who can act, rather than simply appearing in a dashboard. A short post-incident review should document the initial access path, containment decisions, service impact, control gaps and owners for follow-up work.
The response approach can be selected according to the workload’s criticality and the quality of available evidence:
| Situation | Preferred action | Production risk | Evidence priority |
|---|---|---|---|
| Miner on an isolated test host | Quarantine and rebuild | Low | Moderate |
| Miner on a redundant application node | Drain traffic, snapshot and rebuild | Low to medium | High |
| Miner on a single critical server | Fail over if possible, then isolate | Medium | High |
| Repeated infection across cloud accounts | Restrict identities and egress, investigate root access | Medium to high | Very high |
| Miner with signs of credential theft | Treat as a broader compromise | High | Very high |
Recommendations for resilient operations
A practical prevention and response programme should fit existing Australian governance rather than operate as a separate security exercise. The Essential Eight provides useful discipline around application control, patching, multifactor authentication, restricting administrative privileges, backups and incident preparation. It will not eliminate cryptojacking by itself, but it reduces the paths an attacker commonly uses.
Teams should also account for privacy and sector obligations. If investigation reveals access to personal information, assess whether the Notifiable Data Breaches scheme applies. Operators of critical infrastructure may have additional reporting and risk-management responsibilities under Australian law. Legal, privacy and communications advisers should be included early when the infection affects customer data or an essential service.
Use the following controls to reduce recurrence while keeping production stable:
- Establish CPU, memory, network and cloud-cost baselines for every important workload.
- Restrict outbound connections from servers, containers and build agents to approved destinations.
- Require multifactor authentication and short-lived, least-privilege credentials for cloud administration.
- Scan container images, dependencies, infrastructure code and CI/CD changes before deployment.
- Maintain tested golden images and clean recovery environments for rapid host replacement.
- Alert on mining protocols, suspicious process behaviour, privilege changes and unexpected resource creation.
- Run incident exercises with security, engineering, service owners and Australian-based providers.
The strongest operational model combines endpoint detection, cloud workload protection, identity monitoring, network analytics and a coordinated response function. Each tool contributes a different view of the incident; the value comes from connecting those signals quickly. A platform that brings vendor technologies and response workflows together can help teams contain an infection without asking production engineers to improvise under pressure.
Production safety should remain an explicit response objective. Every containment action needs an owner, a success measure and a rollback path. If customer impact begins to rise, shift traffic, add clean capacity or pause the change rather than allowing a security response to become an availability incident.
A cryptojacking infection is a warning that an unauthorised actor has obtained useful access, not merely a sign of wasted processor cycles. Preserve evidence, contain the specific workload, rotate exposed credentials, rebuild from trusted sources and verify the entire environment before declaring recovery. The key principle to remember is that effective remediation removes the attacker while keeping essential Australian business services dependable.