Subscribe to Hexnode Blog
Get fresh insights, pro tips, and thought starters–only the best of posts for you.
BackWhat is a Cryptominer?
A cryptominer is software that uses a computer’s processing power to mine cryptocurrency by validating blockchain transactions and solving cryptographic calculations. Understanding what is a cryptominer helps organizations distinguish between legitimate cryptocurrency mining software and unauthorized mining activity. While organizations and individuals can intentionally use cryptominers for lawful cryptocurrency mining, attackers frequently misuse them to consume victim resources without permission.
Why do attackers use cryptominers?
Cryptocurrency mining requires significant computing power. Rather than paying for hardware and electricity, attackers often install cryptominers on compromised systems to generate cryptocurrency using someone else’s resources.
Attackers use cryptominers to:
- Mine cryptocurrency without authorization
- Exploit enterprise computing resources
- Abuse cloud infrastructure
- Increase financial gain
- Maintain long-term resource usage
These attacks often prioritize stealth so the mining software remains active for extended periods.
How does it work?
A cryptominer performs mathematical calculations required to validate blockchain transactions. It continuously uses available CPU or GPU resources to solve cryptographic problems and earn cryptocurrency rewards.
A typical process includes:
- The cryptominer starts on a device.
- It connects to a mining pool or blockchain network.
- The software performs cryptographic calculations.
- System resources process mining workloads.
- Mining rewards are credited to the configured wallet.
- The mining activity continues until it is stopped.
The software itself performs cryptocurrency mining regardless of whether it operates legitimately or maliciously.
Where are cryptominers commonly found?
Organizations may encounter cryptominers in both legitimate and unauthorized environments.
| Environment | Common purpose |
|---|---|
| Personal computers | Individual cryptocurrency mining |
| Enterprise endpoints | Unauthorized resource consumption |
| Cloud workloads | Large-scale cryptocurrency mining |
| Dedicated mining systems | Legitimate mining operations |
| Compromised servers | Attacker-controlled mining activity |
Security teams should distinguish between approved mining activity and unauthorized software.
What risks do unauthorized cryptominers create?
Unauthorized mining software primarily affects system availability and operational efficiency rather than encrypting or stealing data. Common risks include:
- High CPU and GPU utilization
- Reduced endpoint performance
- Increased power consumption
- Hardware wear from sustained workloads
- Higher cloud infrastructure costs
- Reduced availability of business systems
These impacts can affect both on-premises and cloud environments.
Supporting endpoint security
Unauthorized cryptominers often reveal themselves through unusual resource consumption and persistent background activity. Security teams need visibility into managed endpoints to identify suspicious processes and investigate abnormal system behavior.
Hexnode XDR can support these investigations through:
- Visibility into endpoint activity
- Centralized review of security incidents
- Endpoint scans during investigations
- Context gathering from affected devices
- Remote terminal access when appropriate
- Agent update support across managed endpoints
These capabilities help analysts investigate unauthorized mining activity across enterprise endpoints.
FAQs
No. A cryptominer is legitimate when the owner intentionally installs and operates it. It becomes malicious when attackers install or run it without authorization.
A cryptominer is the mining software itself. Cryptojacking malware secretly installs or runs a cryptominer on a victim’s system without permission.
Yes. Attackers often target cloud workloads because they provide substantial computing resources that can generate cryptocurrency at the victim’s expense.
