Innovative Cyber Tactic Unveils New Method to Halt Cryptominer Assaults

Innovative Cyber Tactic Unveils New Method to Halt Cryptominer Assaults

At a glance

• Breakthrough Research: Akamai researchers found a way to shut down cryptomining botnets from the outside.
• Collaborative Effort: The method turns mining pools’ own anti-abuse rules against the attackers.
• Impact on Businesses: Victims stop paying for stolen computing power once the mining stops.
• A Steady Threat: Cryptojacking remains a quiet drain on cloud and server resources.
• Expert Insights: Akamai released its analysis tools publicly so other defenders can use them.

Turning the pools against the miners

Akamai’s security research team published a new technique in June 2025 for stopping cryptominer campaigns, specifically the many botnets that secretly mine Monero on hijacked machines. Instead of cleaning infected hosts one by one, it cuts off the money. The attack is aimed at the mining infrastructure itself. Most cryptojacking defenses work the other way around.

How “bad shares” work

Mining pools reward miners for submitting valid “shares,” proof of work done on their behalf. They also punish abuse: a connection that keeps submitting invalid shares gets banned. Akamai’s idea exploits that rule. Many botnets route their victims through a mining proxy so the pool sees only one connection, and if that proxy gets banned, every infected machine behind it stops earning the attacker anything.

Who gets hurt by cryptojacking

Cryptominers are covert and hungry for resources. They siphon processing power to mine cryptocurrency for someone else, raising electricity and cloud bills and slowing systems down. An infected machine also signals a security hole that another attacker could use.

XMRogue, the proof of concept

Akamai built a proof-of-concept tool called XMRogue. It poses as a miner connected to the attacker’s XMRig proxy and submits deliberately invalid “bad shares.” The pool then bans the proxy, and mining stops for all victims using it. In Akamai’s tests, an operation producing 3.3 MH/s dropped to zero. For botnets that connect straight to a pool, XMRogue can instead trigger a temporary ban on the attacker’s wallet by opening more than 1,000 simultaneous logins.

Why it is a useful defense

The method gives defenders an option that does not depend on finding and cleaning every infected host. It hits the attacker’s income directly. Akamai has also published its cryptominer analysis tools on GitHub so others can study and track mining campaigns.

Limits and next steps

The technique has limits. Wallet bans are temporary, and attackers can switch proxies or wallets. Still, it adds a new lever against botnets that are otherwise hard to dismantle, and researchers expect miners to adapt.

Expect more work like this. Disrupting attacker infrastructure, not just cleaning victims, is a growing part of defense.

A cheap blow to a quiet crime

Akamai’s research shows that the economics of cryptojacking can be attacked directly. By getting malicious proxies and wallets banned, defenders can stop mining for many victims at once. It will not end cryptojacking. It does make it less profitable, and that is a good start.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.