Signs Linux Server Is Infected with a Crypto Miner

Sustained 100% CPU utilization without corresponding customer traffic spikes is the classic hallmark of an unauthorized cryptocurrency miner (cryptominer) operating on your Linux infrastructure. Beyond degrading application responsiveness and inflating cloud compute billing, mining infections prove that host-level system integrity has been fully compromised.

This guide details the primary Indicators of Compromise (IoC), command-line forensic procedures, and an incident triage workflow to contain and remediate infected Linux hosts.

---

5 Primary Indicators of Compromise (IoC)

Monitor host telemetry for the following behavioral anomalies:

+-------------------------------------------------------------------------------+
|                    5 PRIMARY CRYPTOMINER COMPROMISE INDICATORS                |
+-------------------------------------------------------------------------------+
|  1. Sustained 100% CPU : Sluggish host, load drops instantly upon opening 'top'|
|  2. Outbound Telemetry : Persistent TCP streams to ports 3333, 4444, or 8080   |
|  3. Rogue Cron Entries : Periodic 'curl ... | sh' or 'wget' in /etc/cron.*     |
|  4. Executables in RAM : Binaries running from /tmp, /var/tmp, or /dev/shm    |
|  5. Altered Preload Lib: /etc/ld.so.preload referencing third-party .so roots |
+-------------------------------------------------------------------------------+

---

Command-Line Forensic Investigation

When investigating suspected hosts, avoid immediate server reboots to preserve volatile memory evidence. Execute the following diagnostics:

1. Identify Suspicious Outbound Network Sockets

Inspect active TCP connections using ss or lsof to locate mining pool endpoints:

# Display all listening and established sockets with PID associations
ss -tulpn

# Filter for active outbound ESTABLISHED connections
lsof -i -P -n | grep ESTABLISHED

Examine connections targeting foreign public IPs over non-standard mining protocol ports such as 3333 (Stratum protocol), 4444, 14444, or 8080.

2. Locate Binaries Executing from Temporary and Shared Memory

Adversaries frequently execute malicious payloads from world-writable directories:

# Find active processes mapped to /tmp, /dev/shm, or /var/tmp
ls -l /proc/*/exe 2>/dev/null | grep -E '/tmp|/dev/shm|/var/tmp'

3. Check for Interception Rootkits via Preloaded Libraries

# Verify whether system library preloading has been tampered with
cat /etc/ld.so.preload 2>/dev/null || echo "ld.so.preload is clean"

If /etc/ld.so.preload contains references to files like /usr/local/lib/libprocesshider.so, an interception rootkit is actively masking miner PIDs from administrative utilities.

4. Audit Persistence Hooks: Cron and Systemd Services

# Inspect crontabs across all system user accounts
for user in $(cut -f1 -d: /etc/passwd); do
    crontab -u "$user" -l 2>/dev/null && echo "=== User Crontab: $user ==="
done

# Audit system-wide cron paths and drop-in directories
ls -la /etc/cron* /etc/crontab /var/spool/cron/crontabs/

---

Emergency Incident Triage Workflow

Follow this five-phase containment sequence:

+-------------------------------------------------------------------------------+
|                       INCIDENT TRIAGE CONTAINMENT WORKFLOW                    |
+-------------------------------------------------------------------------------+
|                                                                               |
|  [ 1. Network Containment ] --> Drop outbound streams; restrict admin SSH     |
|              |                                                                |
|              v                                                                |
|  [ 2. Freeze Miner Thread ] --> Issue `kill -STOP <PID>` (Do not use -9 yet)  |
|              |                                                                |
|              v                                                                |
|  [ 3. Remove Persistence  ] --> Purge malicious cron jobs & unauthorized keys |
|              |                                                                |
|              v                                                                |
|  [ 4. Export Clean Data   ] --> Extract database dumps & non-executable assets|
|              |                                                                |
|              v                                                                |
|  [ 5. Reprovision Host    ] --> Deploy pristine hardened image from scratch   |
|                                                                               |
+-------------------------------------------------------------------------------+

Phase 1: Enforce Outbound Network Containment

Prevent the miner from receiving instructions or transmitting proof-of-work hashes:

# Restrict outbound traffic to essential DNS and active SSH sessions
iptables -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -P OUTPUT DROP

Phase 2: Freeze Process Threads Prior to Removal

Avoid issuing kill -9 initially, as automated watchdog daemons will instantly respawn worker processes. Freeze the execution thread first to capture binary forensics:

# Suspend execution of the target process
kill -STOP <MALICIOUS_PID>

# Inspect exact binary backing path on disk
ls -l /proc/<MALICIOUS_PID>/exe

---

Post-Incident Hardening Protocols

Following remediation or host reprovisioning:

1. Disable Password Authentication: Enforce asymmetric Ed25519 SSH public key authentication exclusively.
2. Harden Temporary Mounts: Configure noexec,nosuid,nodev flags on /tmp, /var/tmp, and /dev/shm partitions within /etc/fstab.
3. Deploy Runtime Telemetry: Install continuous host integrity monitoring daemons (e.g., Wazuh or Falco) to flag unauthorized process executions immediately.

---

Conclusion

A cryptominer infection signals an underlying vulnerability in your server security posture. Rapid network containment, comprehensive persistence auditing, and clean automated reprovisioning represent the industry standard for production incident resolution.