THREATNOIR
Subscribe
MITRE ATT&CK · T1496

Resource Hijacking

MITRE · cited in 11 of our lessons

Explanation

What attackers do. Attackers use the computing power, bandwidth or cloud resources of compromised systems for their own purposes, most often cryptocurrency mining, but also proxyware or bulk messaging. This degrades performance and raises costs, and serves the Impact tactic.

How to defend. Set cloud budget and quota alerts, restrict who can create compute resources, and protect cloud credentials and container platforms that are often abused. Monitor resource usage on servers and endpoints. Block known mining pools and proxyware services at the network edge.

Signs to look for. Look for sustained high CPU or GPU use, unexpected new instances or containers, spikes in cloud bills, and connections to mining pools. A common gap is finding it only when the invoice arrives.

Open the technique on MITRE ATT&CK
The official text
Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and/or hosted service availability. Resource hijacking may take a number of different forms. For example, adversaries may: * Leverage compute resources in order to mine cryptocurrency * Sell network bandwidth to proxy networks * Generate SMS traffic for profit * Abuse cloud-based messaging services to send large quantities of spam messages

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.