Resource hijacking (cryptojacking)
Victim compute used for mining or AI workloads
categoryPhysical, insider and cross-cutting attacksseverityMediumdetectabilityHighlabnot yet measured
Classification
31 values: 12 reviewed, 18 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | Medium |
|---|---|
| Impact | Availability |
| Platform | ContainersIaaSLinuxmacOSSaaSWindows |
| Environment | CloudOn-premises |
| Target asset class | Server |
| Kill-chain phase (tactic) | Impact |
Detection & telemetry
| Detectability | High |
|---|---|
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Application Log ContentCloud Service ModificationHost StatusInstance StartNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess Creation |
Detection & response
Detected by 14
- DET0267 attack-detection-strategy
08d6ac24-c927-4469-b3b7-2e422d6e3c43sigma12d027c3-b48c-4d9d-8bb6-a732200034b2sigma25cb259b-bbdc-4b87-98b7-90d7c72f8743sigma66c3b204-9f88-4d0a-a7f7-8a57d521ca55sigma7ee0b4aa-d8d4-4088-b661-20efdf41a04csigma818fee0c-e0ec-4e45-824e-83e4817b0887sigma9069ea3c-b213-4c52-be13-86506a227ab1sigma93e0ef48-37c8-49ed-a02c-038aab23628esigma9541f321-7cba-4b43-80fc-fbd1fb922808sigmaa46c93b7-55ed-4d27-a41b-c259456c4746sigmab593fd50-7335-4682-a36c-4edcb68e4641sigmabf74135c-18e8-4a72-a926-0e4f47888c19sigmafa5b1358-b040-4403-9868-15f7d9ab6329sigma
Tested by 2
44315fb0-f78d-4cef-b10f-cf21c1fe2c75atomic904a5a0e-fb02-490d-9f8d-0e256eb37549atomic
Attack relationships
- Child: Compute resource hijacking
- Child: Cryptojacker
- Child: Proxyjacking / bandwidth hijacking
Framework references
- Primary source: https://attack.mitre.org/tactics/TA0040/
- attack: T1496 (primary)
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Physical, insider and cross-cutting attacks' table, line 712 of Cyber-Attack-Taxonomy.md