A Linux web server has been running at 100% CPU for two days. An analyst finds an unfamiliar process launched from a temporary directory that maintains a persistent outbound connection to an external pool address. No files have been encrypted or renamed and users report no pop-ups. What is the MOST likely explanation?
Select an answer to reveal the explanation.
Short Explanation
Picture someone secretly running a space heater off your power bill. Sky-high CPU, a strange process from a temp folder, and a steady link to an outside pool add up to cryptomining. Ransomware's the tempting guess, but nothing's encrypted, and a logic bomb wouldn't be burning CPU while it waits.
Full Explanation
Cryptomining malware hijacks a system's processing power to mine cryptocurrency for the attacker, so its signature indicators are excessive resource consumption, an unrecognized process often launched from a writable temporary location, and sustained outbound connections to a mining pool that distributes work and collects results. Ransomware's objective is extortion through encryption, and its indicators are renamed or encrypted files, ransom notes, and bursts of disk activity; the stem explicitly states that none of these are present. Adware displays or generates advertising to earn revenue and typically shows up as pop-ups or browser redirects on user-facing systems; a server process holding a single persistent pool connection does not match that behavior. A logic bomb lies dormant until a condition is met, so before triggering it consumes negligible resources, which contradicts two days of maximum CPU use. Exam caveat: resource consumption is a supporting indicator rather than proof on its own, so the process location and the outbound destination are what tie this to mining. Operational check: capture the process details and network connections, compare the binary's hash against threat intelligence, block the pool destination at egress, then isolate the server and determine how the process was launched.