Mitigate cryptocurrency mining attacks on Google Cloud

Cryptocurrency mining (also known as bitcoin mining) is the process used to create new cryptocoins and verify transactions. Cryptocurrency mining attacks occur when attackers who gain access to your environment exploit your resources to run their own mining operations at your expense.

The H1 2026 Cloud Threat Horizons Report warns that the window between vulnerability disclosure and active exploitation has collapsed from weeks to just days. Threat actors can move from initial entry to secondary payload deployment in less than an hour, and use large language models (LLMs) to automate credential harvesting in under 72 hours. Cryptocurrency mining can rapidly increase costs, and a cryptocurrency mining attack can cause a much larger bill than you expected. Because costs can add up quickly, you must put in place protective, detective, and mitigation measures to protect your organization.

This document is intended for security architects and administrators. It describes the best practices that you can take to help protect your Google Cloud resources from cryptocurrency mining attacks and to help mitigate the impact should an attack occur.

For information about how to respond to cryptocurrency mining alerts, see Respond to abuse notifications and warnings.

Identify your threat vectors

To determine your organization's exposure to cryptocurrency mining attacks, you must identify the threat vectors that apply to your organization.

The H1 2026 Cloud Threat Horizons Report indicates that most attackers exploit vulnerabilities such as the following:

  • Vulnerabilities in third-party or user-managed software
  • Weak, absent, or compromised credentials
  • Cloud or application misconfigurations
  • Identity and token abuse (such as OAuth token or OpenID Connect theft)

In addition, you can subscribe to and review the following documents for a list of threat vectors:

After you identify the threat vectors that apply to you, you can use the remaining best practices in this document to help address them.

Protect accounts and account credentials

Attackers can exploit unguarded or mismanaged accounts to gain access to your Google Cloud resources. Google Cloud includes different options that you can configure to manage accounts and groups. Consider the following:

Reduce internet exposure to your Compute Engine and GKE resources

Reducing internet exposure means that your attackers have fewer opportunities to find and exploit vulnerabilities. This section describes the best practices that help protect your Compute Engine VMs and your Google Kubernetes Engine (GKE) clusters from internet exposure.

Restrict external traffic

To restrict external traffic, consider the following:

For more information about restricting external traffic, such as configuring Cloud NAT to allow outgoing communications for VMs without an external IP address or using a proxy load balancer for incoming communications, see Securely connecting to VM instances.

Control access to services

To control access to services, consider the following:

Secure your Compute Engine and GKE resources

Cryptocurrency mining requires compute resources. This section describes the best practices that help you secure your Compute Engine and GKE resources.

Secure your VM images

To help secure your VM images, consider the following:

Restrict service accounts

To help restrict service accounts, consider the following:

For more best practices that help secure service accounts, see Best practices for working with service accounts.

Monitor and patch VMs and containers

To start a cryptocurrency mining attack, attackers often exploit misconfigurations and software vulnerabilities to gain access to Compute Engine and GKE resources.

To monitor and patch VMs and containers, consider the following:

Secure your supply chain

Continuous integration and continuous delivery (CI/CD) provides a mechanism for getting your latest functionality to your customers quickly. To help prevent cryptocurrency mining attacks against your pipeline, perform code analysis and monitor your pipeline for malicious attacks.

Consider the following:

For information on setting up a secure supply chain with GKE, see Software supply chain security.

Manage secrets and keys

A key attack vector for unauthorized cryptocurrency mining attacks is insecure or leaked secrets. This section describes the best practices that you can use to help protect your secrets and encryption keys.

Consider the following:

Detect anomalous activity

To monitor for anomalous activity, configure Google Cloud and third-party monitoring tools and set up alerts. Consider the following:

Participate in the Security Command Center Cryptomining Protection Program

If you are a Security Command Center Premium customer and use Compute Engine, you can participate in the Security Command Center Cryptomining Protection Program. This program lets you defray the Compute Engine VM costs related to undetected and unauthorized cryptomining attacks in your Compute Engine VM environment. You must implement the cryptomining detection best practices, some of which overlap with the other best practices that are described on this page.

Update your incident response plan

Ensure that your incident response plan and your playbooks provide prescriptive guidance for how your organization responds to cryptocurrency mining attacks. For example, ensure that your plan includes the following:

  • How to file a support case with Cloud Customer Care and contact your Google technical account manager (TAM). If you don't have a support account, review the available support plans and create one.
  • How to tell the difference between legitimate high performance computing (HPC) workloads and cryptocurrency mining attacks. For example, you can tag which projects have HPC enabled, and set up alerts for unexpected cost increases.
  • How to deal with compromised Google Cloud credentials.
  • How to quarantine infected systems and restore from healthy backups.
  • Who in your organization must be notified to investigate and respond to the attack.
  • What information needs to be logged for your retrospective activities.
  • How to verify that your remediation activities effectively removed the mining activities and addressed the initial vulnerability that led to the attack.
  • How to respond to an alert sent from Customer Care. For more information, see Policy violations FAQ.

For more information, see Respond to and recover from attacks.

Implement a disaster recovery plan

To prepare for a cryptocurrency mining attack, complete business continuity and disaster recovery plans, create an incident response playbook, and perform tabletop exercises.

If unauthorized cryptocurrency mining occurs, ensure that you can address the threat vector that caused the initial breach and that you can reconstruct your environment from a known good state. Your disaster recovery plan must define what a known good state is so that the attacker can't repeatedly use the same vulnerabilities to exploit your resources.

What's next