What is Cryptojacking? 

 

Cryptojacking is the unauthorised use of victims’ devices or servers to mine cryptocurrency for illicit profits. Attackers who engage in this form of malicious cryptomining aim to remain hidden in their victims’ computer systems or network for as long as possible to maximise the profits gained from cryptomining.  

 

 

How Does a Cryptojacking Attack Happen?  

 

Although the methods by which a cryptojacking attack is carried out may vary, most attacks follow a relatively standard methodology. 

 

• Infection of victims: Victims of phishing attacks often unknowingly get infected by cryptojacking scripts or malware when they open malicious links on their browser or install infected applications on their device. Attackers may also set up fake Wi-Fi hotspots that appear to be legitimate public networks, such as those in coffee shops or airports, and gain unauthorised access to victims’ devices when they connect to these fake networks. 
• Execution of malware or script: Once a device is infected, the cryptomining malware or script runs silently in the background, using the device's central processing unit (CPU) or graphics processing unit (GPU) to solve complex cryptographic puzzles. The rewards gained from solving those puzzles is directed to the attackers’ digital wallet.  

 

The cryptojacking activity may persist undetected, potentially for a long time. To avoid detection, the cryptojacking malware may use anti-analysis techniques, throttle CPU or GPU usage based on user activity, or hide among legitimate background processes. Such cryptojacking scripts often form part of a larger botnet, combining the computational power of many infected devices to maximise financial gains.

 

 

Types of Cryptojacking Attacks 

 

Cryptojacking has evolved to become more sophisticated, manifesting in various forms. Understanding the different types of cryptojacking is crucial in recognising and mitigating its impacts. 

 

Browser-based Attacks 

 

In browser-based cryptojacking, attackers run JavaScript code directly within the victims’ web browser when they visit an infected website or click on a malicious advertisement. The malicious script then runs in the background, utilising the browser’s resources to mine cryptocurrency for as long as they remain on the page. Since this form of cryptojacking does not require installation of software, it is less damaging on the victims’ device but also harder to detect.  

 

System-based Attacks 

 

This type of cryptojacking occurs when a user unknowingly downloads and installs cryptojacking malware onto their device. The cryptomalware runs in the background, using the processing power of the victims’ devices to mine cryptocurrency. The system-based form of cryptojacking is more harmful as it gives attackers greater control over the victim's computer, enabling them to steal sensitive information. 

 

Hybrid Attacks  

 

Hybrid cryptojacking attacks take browser-based attacks a step further. Not only does the malicious script run on the victims’ browser, but it also exploits vulnerabilities in the browser or plugins to drop a payload on the victims’ system. This payload is usually a more persistent form of cryptomining malware that installs itself on the system, allowing it to run continuously even after the browser is closed. Hybrid attacks enable attackers to continue their operations long-term and improve cryptojacking efficiency and profitability.  

 

Cloud-based Attacks 

 

With more organisations shifting their operations to the cloud, cryptojacking attacks that target cloud servers have become more prevalent. Attackers exploit vulnerabilities or use stolen credentials to gain access to cloud infrastructure, then use the compromised resources for cryptomining. Given the vast resources available in cloud infrastructures, attackers can gain significant computational power for their mining operations, making this type of cryptojacking particularly lucrative. 

 

 

Signs That You May Be Under a Cryptojacking Attack 

 

Cryptojacking can be stealthy, but there are several indicators that your system or network may be compromised:

 

• Decreased performance: Your computer or device may become unusually slow or unresponsive. Applications may take longer to load, which may indicate cryptomalware infection. Unresponsiveness of web browsers and automatic opening of multiple tabs may be a sign of cryptojacking scripts affecting web performance. Since cryptojacking consumes excessive power, your device’s battery may also drain unusually quickly. 
• Overheating: Your device may overheat due to the excessive CPU or GPU usage required for cryptocurrency mining. You may notice the device's cooling fans running more frequently or at higher speeds. 
• Increased CPU/GPU usage: A significant spike in CPU or GPU usage even when the system is idle or running minimal applications may indicate that cryptojacking software is running in the background. The Task Manager (for Windows users) or Activity Monitor (for Mac users) may also show high resource usage by unknown or suspicious processes. 
• Unexpected system behaviour: Systems infected with cryptojacking malware may become unstable, crashing frequently or experiencing unexplained reboots. 
• Increased electricity bills: In cloud environments, you may receive unexpected bills for excessive usage of computing resources. This can be a sign that your cloud instances are being used for cryptomining. 
• Unfamiliar processes: Check for unfamiliar processes or services running on your system. Cryptojacking malware often disguises itself, but unusual or unknown processes can still be identified. 
• Alerts from security software: Modern antivirus and anti-malware solutions often detect and alert you to cryptojacking attempts. Pay attention to these alerts and take them seriously. 
• Suspicious browser extensions: Be on the lookout for unwanted or suspicious browser extensions, as they may be vectors for cryptojacking scripts. Regularly review and remove any extensions you do not recognise or need. 

 

 

 

What Are the Implications of a Cryptojacking Attack? 

 

Cryptojacking attacks may often be perceived as less harmful than other forms of cybercrime because it does not directly damage victims’ computers or steal data. However, the covert nature of these attacks means they can go undetected for extended periods of time, silently draining resources and potentially causing considerable damage. 

 

Due to the considerable amounts of CPU and GPU resources that cryptojacking malware and scripts consume, slower system performance and more frequent system lags and crashes may significantly reduce productivity for victims and businesses. 

 

Financial losses incurred from the increased energy consumption, repair and replacement of hardware, and remediation costs may place heavy financial burden on victimised businesses. 

 

Network security may also be compromised as cryptojacking malware may create backdoors that allow attackers to deploy additional malware, potentially exfiltrating sensitive data and spreading to other systems across the network.  

 

Over time, reputational damage to organisations may be severe if the cryptojacking operations negatively affect organisations’ service quality or cause service disruptions. Customer and investor trust may erode, potentially leading to the loss of business opportunities and partnerships.  

 

 

How to Defend Against Cryptojacking Attacks? 

 

Protecting your systems and networks from cryptojacking attacks requires a comprehensive approach that addresses both prevention and detection. Given the stealthy nature of these attacks, it is essential to implement robust security measures across all potential points of entry. 

 

Maintain Browser Security 

 

Many cryptojacking scripts rely on JavaScript to execute. Disabling JavaScript in browsers when it is not needed or using ad-blockers and script-blockers may prevent these malicious scripts from running on the browser, thus defending against browser-based cryptojacking attempts.  

 

Employee Training 

 

By empowering employees with cybersecurity awareness, organisations can turn them into a proactive defence system. Regular training sessions can equip them with the knowledge to identify signs of cryptojacking, and practice safe browsing habits such as avoiding untrusted websites and downloading software only from reputable sources. 

 

Cloud Security Measures 

 

Regular monitoring of cloud instances for unusual activity, such as spikes in CPU usage or unauthorised instance creation, may aid in early detection of cryptojacking activities. Organisations should also implement strict access controls and multi-factor authentication to secure cloud environments, ensuring that only authorised personnel have access to critical resources. Cloud-native security tools like Microsoft Defender should also be used to continuously analyse and improve security posture. 

 

Regular Software Updates 

 

Regular updating and patching of computer systems is essential for maintaining a robust defence against cryptojacking attacks. Pay special attention to critical security updates and patches and prioritise their installation. This proactive approach helps to reduce the risk of exploitation and infection by cryptojacking malware.  

 

Endpoint Detection and Response (EDR) 

 

Implementing EDR solutions to monitor endpoints for suspicious activities may enhance detection of potential cryptojacking attempts and reduce response times. EDR tools can detect abnormal behaviour associated with cryptojacking and provide alerts for quick response. 

 

Addressing cryptojacking attacks on ever-growing attack surfaces may be complex and burdensome for organisations to maintain and operate, especially without a comprehensive support system. Ensign’s Managed Detection and Response service provides a holistic solution to mitigate cryptojacking threats, leveraging the expertise of specialists, technology partners and advanced capabilities to detect and respond to cryptojacking attempts fast and accurately.  

 

 

Prevent Cryptojacking with Ensign's Managed Detection and Response (MDR) 

 

Ensign's MDR offers: 

 

• 24/7 Threat hunting: Our security experts constantly monitor your systems for signs of cryptojacking and other cyber threats. 
• Threat intelligence integrated operations: Our credible cyber threat intelligence enable early warning and detection capabilities through advanced analytics.  
• Rapid response: We take immediate action to isolate and neutralise threats, minimising system damage and downtime. 
• Expert guidance: Our team provides ongoing security advice and recommendations to strengthen your cyber posture.  

 

Learn more about our Managed Detection and Response (MDR) services.