[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1496":3},{"item":4,"lessons":18,"controls":64,"related":94},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1496","T1496","Resource Hijacking",11,"MITRE","**What attackers do.** Attackers use the computing power, bandwidth or cloud resources of compromised systems for their own purposes, most often cryptocurrency mining, but also proxyware or bulk messaging. This degrades performance and raises costs, and serves the Impact tactic.\n\n**How to defend.** Set cloud budget and quota alerts, restrict who can create compute resources, and protect cloud credentials and container platforms that are often abused. Monitor resource usage on servers and endpoints. Block known mining pools and proxyware services at the network edge.\n\n**Signs to look for.** Look for sustained high CPU or GPU use, unexpected new instances or containers, spikes in cloud bills, and connections to mining pools. A common gap is finding it only when the invoice arrives.","Adversaries may leverage the resources of co-opted systems to complete resource-intensive tasks, which may impact system and\u002For hosted service availability. \n\nResource hijacking may take a number of different forms. For example, adversaries may:\n\n* Leverage compute resources in order to mine cryptocurrency\n* Sell network bandwidth to proxy networks\n* Generate SMS traffic for profit\n* Abuse cloud-based messaging services to send large quantities of spam messages","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1496\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60],{"slug":21,"title":22,"published_at":23},"ahsaycbs-vulnerabilities-exploited-to-deploy-disguised-crypto-miners","AhsayCBS Vulnerabilities Exploited to Deploy Disguised Crypto Miners","2026-10-09T16:21:54.955+00:00",{"slug":25,"title":26,"published_at":27},"unpatched-ahsaycbs-backup-flaws-weaponized-for-crypto-mining","Unpatched AhsayCBS Backup Flaws Weaponized for Crypto Mining","2026-10-09T12:20:56.625+00:00",{"slug":29,"title":30,"published_at":31},"poellm-botnet-exploits-exposed-ai-infrastructure-to-mine-crypto-on-3400-servers","PoeLLM Botnet Exploits Exposed AI Infrastructure to Mine Crypto on 3,400+ Servers","2026-10-07T18:21:48.858+00:00",{"slug":33,"title":34,"published_at":35},"exposed-ai-servers-hijacked-for-cryptomining-via-poellm-malware","Exposed AI Servers Hijacked for Cryptomining via PoeLLM Malware","2026-10-07T16:20:21.445+00:00",{"slug":37,"title":38,"published_at":39},"on-machine-cryptominer-compilation-exposes-attackers-who-exploited-unpatched-cve","On-Machine Cryptominer Compilation Exposes Attackers Who Exploited Unpatched CVE","2026-09-25T14:21:02.041+00:00",{"slug":41,"title":42,"published_at":43},"revstealer-modules-disable-windows-defender-and-update-to-deploy-crypto-miner","REVSTEALER Modules Disable Windows Defender and Update to Deploy Crypto Miner","2026-09-06T10:20:38.502+00:00",{"slug":45,"title":46,"published_at":47},"ai-infrastructure-gateways-exploited-for-credential-theft-and-cryptomining","AI Infrastructure Gateways Exploited for Credential Theft and Cryptomining","2026-08-26T20:22:19.974+00:00",{"slug":49,"title":50,"published_at":51},"macos-screen-sharing-flaw-exploited-for-cryptomining-after-delayed-patching","macOS Screen Sharing Flaw Exploited for Cryptomining After Delayed Patching","2026-08-17T10:20:57.233+00:00",{"slug":53,"title":54,"published_at":55},"clickfix-attacks-on-steam-forums-spread-xmrig-cryptominer-via-social-engineering","ClickFix Attacks on Steam Forums Spread XMRig Cryptominer via Social Engineering","2026-07-26T00:20:19.825+00:00",{"slug":57,"title":58,"published_at":59},"exposed-ssh-port-on-ai-gateway-leads-to-cryptomining-compromise","Exposed SSH Port on AI Gateway Leads to Cryptomining Compromise","2026-07-09T18:20:36.582+00:00",{"slug":61,"title":62,"published_at":63},"ai-gateways-become-attacker-entry-points-to-cloud-and-iam-infrastructure","AI Gateways Become Attacker Entry Points to Cloud and IAM Infrastructure","2026-07-09T14:20:51.227+00:00",[65,70,75,80,85,89],{"slug":66,"name":67,"problem":68,"stories":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",9,{"slug":71,"name":72,"problem":73,"stories":74},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",5,{"slug":76,"name":77,"problem":78,"stories":79},"patch-management","Automated patch management","Known holes get closed in days, not months.",4,{"slug":81,"name":82,"problem":83,"stories":84},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",3,{"slug":86,"name":87,"problem":88,"stories":84},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":90,"name":91,"problem":92,"stories":93},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,[95,101,105,109,115,119,123,127],{"family":96,"item":97,"code":98,"title":99,"together":100},"cis","12","Control 12","Network Infrastructure Management",7,{"family":96,"item":102,"code":103,"title":104,"together":100},"7","Control 7","Continuous Vulnerability Management",{"family":96,"item":106,"code":107,"title":108,"together":100},"13","Control 13","Network Monitoring and Defense",{"family":110,"item":111,"code":112,"title":113,"together":114},"nist-800-53","sc-7","SC-7","Boundary Protection",6,{"family":96,"item":116,"code":117,"title":118,"together":114},"4","Control 4","Secure Configuration of Enterprise Assets and Software",{"family":110,"item":120,"code":121,"title":122,"together":74},"cm-6","CM-6","Configuration Settings",{"family":110,"item":124,"code":125,"title":126,"together":74},"si-2","SI-2","Flaw Remediation",{"family":110,"item":128,"code":129,"title":130,"together":74},"si-3","SI-3","Malicious Code Protection"]