[Gys]

> In all the attacks observed, the malware was used to run a cryptominer

I assume it starts by detecting a continuous 100% utilization of the cpu’s.

[jellykid]

Supposedly it tones down it's activity while a user is logged in and waits for the machine to go idle. Another reason to have centralized performance monitoring.

[Gys]

Yes, but tools like htop show the average load over the last 15 min. So I assume that will show a high utilization.