What is resource hijacking?¶

Resource hijacking is the unauthorised use of computing, storage, network or service capacity for another person’s purpose.

Evidential caution: that resource abuse is limited to cryptomining.

What this means¶

It may also support:

proxy services;

botnets;

spam;

credential attacks;

malware hosting;

data storage;

denial of service;

password cracking;

automation;

resale of access.

which resource was used;

what workload or service ran;

who or what launched it;

which account or system was involved;

what destination or beneficiary existed;

what cost or operational impact followed;

whether authority existed.

A compromised server may host several abusive workloads at once.

Likewise, resource consumption may continue after the original offender session ends because scheduled jobs or services remain active.

The same compromised resource may be sold or shared with another offender after initial access. Preserve changes in workload, destination and account use. Different abusive services on one host may represent one controller, several customers or sequential compromise.

Resource hijacking may also degrade legitimate services without exhausting the whole system. Increased latency, quota use, storage consumption or reputation damage may be the main impact. Measure the specific resource and operational consequence rather than relying only on processor utilisation.

That broader impact should be measured separately.

================================================================================

What to check or do next¶

• Investigators should identify:
• Preserve workload configuration, process activity, cloud or system logs, network records, billing and provider evidence.
• Record it clearly. The operational takeaway is:
• Identify the actual unauthorised workload and beneficiary, and do not reduce resource abuse to one technology or one visible process.

Evidential limits¶

Do not assume one process explains the whole incident.