You can lose money without losing data. T1496, Resource Hijacking, is when adversaries use the resources of compromised systems for work that benefits them and costs you. MITRE files it under impact. It covers Windows, IaaS, Linux, macOS, containers and SaaS, and it has four sub techniques.
How attackers use it
MITRE lists several forms. Adversaries may use compute resources to mine cryptocurrency, sell network bandwidth to proxy networks, generate SMS traffic for profit, or abuse cloud based messaging services to send large volumes of spam. Sometimes they combine more than one at once.
The impact is not only cost. Heavy use can reduce availability of the system or hosted service.
The sub techniques split along those lines:
- Compute hijacking (T1496.001), mainly cryptocurrency mining.
- Bandwidth hijacking (T1496.002), including botnets, torrent seeding and proxyjacking.
- SMS pumping (T1496.003), where a threat actor uses a victim's messaging infrastructure to send SMS to numbers they profit from.
- Cloud service hijacking (T1496.004), including mass email and SMS through compromised SaaS and abuse of hosted AI models.
MITRE's introduction cites a 2023 report on a campaign that targeted GitLab for cryptojacking and proxyjacking.
How to detect it
MITRE's detection strategy has six analytics.
- Windows: sustained high CPU use along with suspicious command line activity, such as mining tools or obfuscated scripts, and outbound connections to mining or proxy networks.
- Linux: unauthorized processes with abnormal CPU or memory use that contact mining pools, or that persist through scheduled jobs or scripts.
- macOS: background launch agents or daemons using heavy CPU and reaching external mining services.
- Cloud VMs: sudden CPU spikes with outbound traffic to mining pools, plus unauthorized instance creation.
- Containers: unauthorized containers running mining binaries or public proxy tools while using high CPU.
- Messaging: misuse of cloud messaging platforms to send mass spam or exhaust quota based resources.
MITRE names no log sources. Useful data sources are host and container CPU metrics, process and network telemetry, cloud billing and usage alerts, and quota alerts on messaging services.
Cost alerts are underrated. A budget alarm on a cloud account is often the first sign.
How to reduce the risk
MITRE states this technique is hard to prevent with preventive controls because it abuses legitimate system features. That makes monitoring the main defense, along with basics that keep intruders out: patching, tight credentials, and limited ability to create instances and containers.
Practical steps:
- Set budget and anomaly alerts on every cloud account, and on third party messaging services.
- Restrict who can launch compute, especially in regions you do not use.
- Apply rate limits and CAPTCHA to any form that triggers messages.
- Set resource limits on containers so one workload cannot consume a whole node.
- Block egress to known mining pools where you can.
Check your own environment
- Check that every cloud account has a billing alert, and who receives it.
- List running instances and containers and confirm each has an owner.
- Look for regions with resources that you do not use.
- Review which hosts have sustained CPU use above their normal level, and why.
Quick check
Name three forms of resource hijacking from MITRE.
Cryptocurrency mining, selling bandwidth to proxy networks, SMS traffic generation, and abusing messaging services for spam.
Why does MITRE say prevention is difficult?
The technique abuses legitimate system features, so detection is the main focus.
