[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1496":3},{"item":4,"lessons":18,"controls":69,"related":97},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1496","T1496","Resource Hijacking",11,"MITRE","**What attackers do.** Attackers use the computing power, bandwidth or cloud resources of compromised systems for their own purposes, most often cryptocurrency mining, but also proxyware or bulk messaging. This degrades performance and raises costs, and serves the Impact tactic.\n\n**How to defend.** Set cloud budget and quota alerts, restrict who can create compute resources, and protect cloud credentials and container platforms that are often abused. Monitor resource usage on servers and endpoints. Block known mining pools and proxyware services at the network edge.\n\n**Signs to look for.** Look for sustained high CPU or GPU use, unexpected new instances or containers, spikes in cloud bills, and connections to mining pools. A common gap is finding it only when the invoice arrives.","Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and\u002For hosted service availability. \n\nResource hijacking may take a number of different forms. For example, adversaries may:\n\n* Leverage compute resources in order to mine cryptocurrency\n* Sell network bandwidth to proxy networks\n* Generate SMS traffic for profit\n* Abuse cloud-based messaging services to send large quantities of spam messages","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1496\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},13,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"canadian-hackers-compromise-us-schools-for-crypto-mining","Canadian Hackers Compromise US Schools for Crypto Mining","2026-11-04T20:20:45.124+00:00",{"slug":26,"title":27,"published_at":28},"supercomputer-cryptojacking-highlights-academic-network-security-gaps","Supercomputer Cryptojacking Highlights Academic Network Security Gaps","2026-11-04T13:21:51.408+00:00",{"slug":30,"title":31,"published_at":32},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","2026-10-09T16:21:54.955+00:00",{"slug":34,"title":35,"published_at":36},"unpatched-ahsaycbs-backup-flaws-weaponized-for-crypto-mining","Unpatched AhsayCBS Backup Flaws Weaponized for Crypto Mining","2026-10-09T12:20:56.625+00:00",{"slug":38,"title":39,"published_at":40},"poellm-botnet-exploits-exposed-ai-infrastructure-to-mine-crypto-on-3400-servers","PoeLLM Botnet Exploits Exposed AI Infrastructure to Mine Crypto on 3,400+ Servers","2026-10-07T18:21:48.858+00:00",{"slug":42,"title":43,"published_at":44},"exposed-ai-servers-hijacked-for-cryptomining-via-poellm-malware","Exposed AI Servers Hijacked for Cryptomining via PoeLLM Malware","2026-10-07T16:20:21.445+00:00",{"slug":46,"title":47,"published_at":48},"on-machine-cryptominer-compilation-exposes-attackers-who-exploited-unpatched-cve","On-Machine Cryptominer Compilation Exposes Attackers Who Exploited Unpatched CVE","2026-09-25T14:21:02.041+00:00",{"slug":50,"title":51,"published_at":52},"revstealer-modules-disable-windows-defender-and-update-to-deploy-crypto-miner","REVSTEALER Modules Disable Windows Defender and Update to Deploy Crypto Miner","2026-09-06T10:20:38.502+00:00",{"slug":54,"title":55,"published_at":56},"ai-infrastructure-gateways-exploited-for-credential-theft-and-cryptomining","AI Infrastructure Gateways Exploited for Credential Theft and Cryptomining","2026-08-26T20:22:19.974+00:00",{"slug":58,"title":59,"published_at":60},"macos-screen-sharing-flaw-exploited-for-cryptomining-after-delayed-patching","macOS Screen Sharing Flaw Exploited for Cryptomining After Delayed Patching","2026-08-17T10:20:57.233+00:00",{"slug":62,"title":63,"published_at":64},"clickfix-attacks-on-steam-forums-spread-xmrig-cryptominer-via-social-engineering","ClickFix Attacks on Steam Forums Spread XMRig Cryptominer via Social Engineering","2026-07-26T00:20:19.825+00:00",{"slug":66,"title":67,"published_at":68},"exposed-ssh-port-on-ai-gateway-leads-to-cryptomining-compromise","Exposed SSH Port on AI Gateway Leads to Cryptomining Compromise","2026-07-09T18:20:36.582+00:00",[70,74,79,83,88,93],{"slug":71,"name":72,"problem":73,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":75,"name":76,"problem":77,"stories":78},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",5,{"slug":80,"name":81,"problem":82,"stories":78},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":84,"name":85,"problem":86,"stories":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":89,"name":90,"problem":91,"stories":92},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",3,{"slug":94,"name":95,"problem":96,"stories":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[98,104,108,113,118,123,127,131],{"family":99,"item":100,"code":101,"title":102,"together":103},"cis","13","Control 13","Network Monitoring and Defense",8,{"family":99,"item":105,"code":106,"title":107,"together":103},"7","Control 7","Continuous Vulnerability Management",{"family":99,"item":109,"code":110,"title":111,"together":112},"12","Control 12","Network Infrastructure Management",7,{"family":114,"item":115,"code":116,"title":117,"together":112},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":99,"item":119,"code":120,"title":121,"together":122},"4","Control 4","Secure Configuration of Enterprise Assets and Software",6,{"family":114,"item":124,"code":125,"title":126,"together":122},"sc-7","SC-7","Boundary Protection",{"family":114,"item":128,"code":129,"title":130,"together":78},"cm-6","CM-6","Configuration Settings",{"family":114,"item":132,"code":133,"title":134,"together":78},"si-3","SI-3","Malicious Code Protection"]