How to Prevent Cryptojacking: Complete Detection & Protection Guide

Cryptojacking is the hybrid of cryptocurrency and hijacking. At its core, your computer/laptop, mobile device, or server is hijacked and used for mining cryptocurrency for the cybercriminal behind the scenes. Cryptojacking malware doesn't want to encrypt your data and ask for ransom like we often see with ransomware attacks. Cryptojacking malware wants to use your CPU and all of your processing power so it can mine for cryptocurrency coins.

Preventing cryptojacking involves using a multi-layered monitoring approach built around network monitoring, CPU usage detection, and proactive cybersecurity defense. Here is a complete step-by-step guide to preventing cryptojacking with advanced monitoring using PRTG Network Monitor and cybersecurity best practices used by enterprise IT pros.

Why Preventing Cryptojacking is Critical for Your Infrastructure

Cryptocurrency mining is a fine balancing act to ensure profitability vs costs. When malware is added into the crypto mining equation by a cybercriminal using cryptojacking malware, the entire equation's cost falls on the shoulders of the device being infected. The computing power (CPU performance) and energy/electricity cost is provided by the end users that are often unaware that illicit cybercrime is taking place on their endpoint computing devices.

Cryptojacking malware can affect any Windows device, smartphone, and even cloud services that have the ability to perform the computational math hashing needed to mine for cryptocurrency coins. While these devices may not net large amounts of Bitcoin or Monero coins, threat actors will attempt to enslave as many devices as possible to turn a profit while also causing overheating and high energy bill costs.

Preventing cryptojacking starts with continuous CPU usage monitoring and sustained resource usage detections. PRTG's sensors provide the operational visibility needed to identify cryptojacking before it impacts your infrastructure and energy costs.

How to Prevent Cryptojacking with PRTG CPU Monitoring Sensors

Not long ago, I helped document a PRTG use case to monitor a set of well known websites for the removal of cryptojacking malware. In my use case, PRTG let me continuously monitor the websites so I was instantly notified when the malware was removed. The same principle applies for your own infrastructure – from bare-metal servers on premises to virtual machines running in the cloud. PRTG provides the monitoring visibility data needed to prevent cryptojacking before you are stuck with higher energy bills or cloud services compute resource overages.

Preventing Cryptojacking with PRTG Sensors: Step-by-Step Setup 

Key Benefits:

• Multi-layered Detection - Correlate multiple sensor types for a holistic view to prevent cryptojacking attacks

• Lower False Positives - Use CPU, memory, and network data correlation for more accurate cryptojacking alerts
• Cross-Platform Coverage - Monitor Windows, Linux, cloud services, and network infrastructure
• Immediate Alerts - Get real time notifications when cryptojacking is detected

That should give you a clear understanding of how to prevent cryptojacking with the right monitoring setup. Next let's dive into a more complete set of cryptojacking prevention best practices.

Advanced Cryptojacking Prevention Strategies

Network Traffic Analysis for Cryptojacking Prevention:

PRTG goes beyond the basic CPU and memory usage monitoring methods and provides network flow sensors that can detect cryptojacking malware by identifying outbound traffic patterns to cryptomining pools. Cryptojacking malware often creates constant, repeated outbound connections to known port ranges used for cryptomining protocols including Bitcoin, Monero, and other cryptocurrency coins.

Memory Usage Correlation:

Correlate CPU usage with PRTG's WMI Memory sensors to detect the memory usage patterns unique to cryptojacking activity. Legitimate high CPU usages usually correlate with proportional memory usage, while cryptojacking malware often has different memory allocation patterns that signal code execution for cryptocurrency mining.

Multi-Layered Detection Approach:

Build on PRTG's core sensor detection by using the Sensor Factory feature to create custom composite sensors that correlate CPU, memory, and network data into a single cryptojacking risk score. This advanced approach can lower false positives while also improving detection accuracy against more targeted cryptojacking malware.