How do we spot cryptomining in a compromised cloud account?
Usually first on the bill, which is why budget alerts are the cheapest detection you can set up. Attackers who obtain cloud credentials often start many powerful virtual machines or containers, frequently in regions you never use, to mine cryptocurrency at your expense. Signs: a sudden rise in compute spend or in the number of instances, machines with GPU types nobody ordered, new resources in unfamiliar regions, new access keys or users created around the same time, and servers running at full CPU around the clock. On a server you operate, a mining process also shows on the network: steady, long-lived connections to mining pools, often on unusual ports, from a machine that normally only serves web requests. Respond by revoking the credentials used, removing what the attacker created in every region, checking for persistence such as new users, roles and scheduled functions, and asking the provider about charges. NetSenX sees the network behaviour of servers that carry its agent, such as regular connections to an unknown destination; it does not watch your cloud bill or resources it has no agent on.