ethminer

Ethminer is an open-source Ethereum cryptocurrency mining program used to perform GPU-accelerated cryptomining on systems with suitable graphics hardware. Although it is legitimate software, it is frequently repurposed by threat actors as a malicious payload in cryptojacking operations. Observed abuse includes deployment in compromised Kubernetes and Kubeflow environments, where attackers launch GPU-capable containers to mine Ethereum, and installation on compromised Windows hosts as part of broader malware chains.

In cloud-native intrusions, Ethminer has been used in campaigns targeting internet-exposed Kubeflow deployments. Attackers abused insecure access to Kubeflow dashboards and pipelines to create malicious workflows that launched TensorFlow GPU containers and executed Ethminer to monetize cluster GPU resources. These operations were accompanied by reconnaissance of available CPU and GPU capacity and were designed to blend into machine-learning environments by using legitimate container images.

Ethminer has also appeared as a secondary payload in Windows crimeware activity associated with ServHelper campaigns linked with moderate confidence to TA505 or a related cluster. In those intrusions, the miner was conditionally deployed after host profiling indicated suitable graphics capability, then staged in encrypted form and reflectively injected into a legitimate process to evade detection. In this role, Ethminer functioned as a monetization component alongside remote-access, credential and cookie theft, and other post-compromise capabilities provided by the primary malware.

When abused maliciously, Ethminer’s role is cryptomining rather than access brokerage or data theft. Its observed malicious use is typically post-compromise and depends on prior unauthorized access established through exposed administrative interfaces or multi-stage malware delivery chains.