Nobody knows for sure what they were doing since the script dropped via the salt vulnerability downloaded new scripts and executed them every 60 seconds. Just because all they found were crypto miners doesn't mean it was the only thing it was doing. And also there were multiple groups exploiting this vulnerability at the same time as was evidenced in one of the scripts trying to detect and eliminate competing scripts dropped by someone else

Cryptocurrency continues to improve security by polluting attackers with short-sighted incentives that prevent real damage from occurring.

3 max-expensive "analytics" servers were how my company discovered a breach. "Why is our cost projected to go up so significantly?"

They were of course mining on GPUs.

I don't think cryptocurrency has changed much in that regard. Before CC mining the default use for an owned box was warez servers, IRC or jump hosts.

Those are much harder to detect, especially the latter two.

I'm not sure. Most crackers don't use port knocking or other obfuscation techniques, so something that shouldn't be listening on a box and a large amount of bandwidth being used is normally a good indicator.

I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits. If you're monitoring your servers for unknown listening ports, chances are you're keeping your systems up to date. Same with bandwidth, although if bandwidth is expensive (eg. cloud providers), your accounting dept might notice.

> I think there's great overlap between servers that aren't monitored and servers that are vulnerable to exploits.

Agreed. CC mining would be CPU on most servers, and go undetected for the same reasons. Some servers and gaming rigs would have GPUs, but not many vs CPUs.

Two approaches to doing nasty things on other people's servers: 1) be very quiet and try not to get caught at all. 2) be very noisy doing something "innocent" like running a bitcoin miner.

If you do not assume that everything bad that could have happened, did happen, then you will have some interesting explaining to do later, with lawyers.