Detect Cloud GPU / Compute-Optimized Instance Burst Provisioning for Cryptocurrency Mining in IBM QRadar

Once an adversary obtains valid cloud credentials (a leaked IAM access key, an over-permissioned CI/CD service principal, or a session hijacked via token theft), one of the most direct ways to monetize that access is Resource Hijacking: rather than exfiltrating data or staging ransomware, the actor simply rents the victim's own compute at the victim's expense to mine cryptocurrency. The observable pattern is distinctive from routine autoscaling or ML workload provisioning: the actor scripts a burst of RunInstances (AWS) or Microsoft.Compute/virtualMachines/write (Azure) calls requesting GPU-accelerated or bare-metal compute-optimized instance families (AWS p3/p3dn/p4d/p4de/p5, g4dn/g4ad/g5/g5g/g6, trn1/inf2, and .metal families; Azure NC/ND/NV/HB/HC series) — the same instance classes used for legitimate ML training and HPC, chosen specifically for their hash-rate-per-dollar economics rather than any workload the victim actually asked for. Launches are frequently fanned out across multiple regions or even multiple linked accounts/subscriptions in the same short window to slip under any single region's service quota and to slow discovery, since most organizations' cost anomaly alerting operates on a daily or slower cadence while the mining operation itself can be running within minutes of credential compromise. Once running, the instances typically establish outbound TCP connections on ports associated with the Stratum mining protocol (3333, 4444, 5555, 7777, 8080, 14444, 14433, 45560) to a mining pool endpoint, and sustain near-100% CPU/GPU utilization for as long as the credentials remain valid — the direct cost impact (often tens of thousands of dollars within a day for GPU-class instances) is frequently the first signal a victim organization notices, arriving as a shocking cloud bill days after the actual compromise.