What is cryptomining malware, or cryptojacking?

Cryptomining malware, also called cryptojacking, secretly installs a cryptocurrency miner on a device and uses its processor to generate digital currency for an attacker. Unlike ransomware or a data breach, it does not lock files or steal records. It steals computing power. The device keeps working, just slower, which is why an infection can run for weeks before anyone connects the slowdown to a security problem rather than aging hardware.

Can antivirus detect cryptomining malware?

Not reliably. The variant our sensors recorded in March 2026 was detected by only 1 of 65 antivirus engines because the attacker repackaged and compressed the file to defeat signature matching. Signature antivirus can only catch malware it already recognizes. Detecting a brand-new build requires behavioral monitoring that watches what a program does, such as sustained high processor use and connections to mining pools, rather than what its file looks like.

Is a cryptominer infection a HIPAA security incident?

Yes. Under 45 CFR 164.304, a security incident is any attempted or successful unauthorized access to, or interference with, an information system. A cryptominer is unauthorized access and unauthorized use of processing capacity, so it meets the definition even if the attacker never touches resident records. That triggers your incident response, documentation, and risk assessment obligations regardless of whether protected health information was viewed.

How does cryptomining malware get onto senior living systems?

The most common paths are weak or default remote-login credentials and unpatched internet-facing equipment such as firewalls, VPN gateways, and cameras. In the campaign we observed, the attacker logged in over SSH using guessed default passwords. Eliminating default credentials, disabling password-based remote login in favor of keys, and keeping edge devices patched close the doors these campaigns rely on.

Back to Insights

Cryptomining Malware in Senior Living: Why Antivirus Misses It

August 5, 2026 · Tech for Senior Living

Cryptomining malware is one of the quietest threats a senior living community faces, because it is designed not to be noticed. It does not lock your files like ransomware or exfiltrate resident records. It installs a hidden cryptocurrency miner and steals the one resource nobody is watching: your computing power. In March 2026, Tech for Senior Living's threat-monitoring sensors recorded a live example of exactly this, and the most important detail was how close to invisible it had become.

What Our Sensors Recorded

Over roughly a week in mid-March 2026, our sensors captured six separate deployment sessions from a single attacker distributing a variant of RedTail, a Monero cryptocurrency miner. The attacker gained entry the low-effort way, by logging in over SSH with guessed default passwords, then uploaded miner binaries built for four different processor types: 32-bit and 64-bit ARM chips (the kind in cameras, sensors, and small appliances) alongside 32-bit and 64-bit Intel chips (the kind in workstations and servers). One package for nearly any device on a network.

Two behaviors marked this as a professional operation rather than opportunistic noise. First, the attacker returned again and again over eight days, redeploying to re-infect anything that had been cleaned. Second, the campaign shipped an updated build partway through that was 45 percent smaller than the previous version and compressed with a packer specifically to frustrate analysis tools. That updated file was flagged by only 1 of 65 antivirus engines that scanned it. For practical purposes, roughly 98 percent of signature antivirus products would have let it through.

Why Cryptojacking Is Worse in a Care Setting Than It Sounds

"It only mines cryptocurrency" sounds harmless until you translate it into a building full of residents who depend on systems working. Cryptomining is classified by the MITRE ATT&CK framework as Resource Hijacking: the malware consumes processor cycles, memory, and power to serve the attacker instead of the community. In a senior living environment, that surfaces in ways staff rarely trace back to a compromise:

Electronic health record charting that lags during a medication pass, when timing matters most.
Nurse call and monitoring consoles that respond a beat slower than they should.
Workstations that overheat, throttle, or die early because they run flat out around the clock.
A steady trickle of "the system is slow again" tickets that never get root-caused and quietly become the accepted normal.

There is also a direct compliance dimension. Any unauthorized access to a system that stores or processes protected health information is a reportable security incident under 45 CFR 164.304, whether or not the attacker's goal was the data. A miner running on a nurse-station PC is unauthorized access by definition. It puts the community squarely inside its HIPAA incident-response and documentation obligations, and a device an attacker controls for cryptomining is a device they can repurpose for something worse.

The Real Lesson: Signatures Are Not Enough

The single most important takeaway from this campaign is the detection rate. A 1-in-65 result is not a fluke; it is the whole business model. Attackers now iterate builds against public scanning services the same way a developer iterates against a test suite, shrinking and repackaging the file until it stops matching known signatures. Traditional antivirus, which works by comparing a file to a library of things it already recognizes, is structurally unable to catch a brand-new build on day one.

What does catch it is behavior. A cryptominer, no matter how it is packaged, has to do the same handful of things to earn money: peg the processor for long stretches, reach out to a mining pool over the network, and install itself to survive a reboot. Watching for those actions, rather than for a file fingerprint, is the difference between finding this in an hour and finding it after a resident's family asks why the front desk computer takes two minutes to load. National guidance has said as much for years: NIST Special Publication 800-83 treats layered, behavior-aware defense as the baseline for malware prevention, and the CIS Controls list behavioral malware defenses among their core safeguards precisely because signatures alone leave a gap this wide.

What Actually Stops This

The good news is that this class of attack is defeated by controls a well-run managed program should already be enforcing. None of them are exotic.

Eliminate default and weak credentials. The entire campaign started with a guessed password. Every device, from servers down to cameras, gets a unique strong credential before it touches the production network. This is the same discipline that shuts down the camera-scanning botnets we have written about before.
Disable password-based remote login. Where remote administration is needed, require key-based authentication so a guessed password is not even an option.
Deploy behavioral monitoring, not just antivirus. Continuous monitoring that flags sustained processor spikes, mining-pool connections, and unexpected scheduled tasks catches what signatures miss. This is the core of a managed detection and response layer.
Filter outbound traffic. Miners must reach a mining pool to pay out. Blocking those connections at the firewall neutralizes the malware even if a build slips onto a device.
Segment the network and patch the edge. Keeping cameras and other appliances on isolated segments limits the blast radius, and keeping internet-facing firewalls and gateways patched closes the other main door these campaigns use. See our guidance on network segmentation.
Keep training current. Staff who understand that "slow" can mean "compromised" report it instead of tolerating it. Our security awareness training overview covers how to build that reflex.

The broader point is the one we make throughout our cybersecurity guide for senior living: protection is a set of layers, not a single product. The attacker in this case beat the most common single layer, antivirus, on their first try. Communities that relied on that layer alone would not have known they were infected until the performance complaints piled up, if ever. Communities running behavioral detection, credential hardening, and egress filtering would have caught it at the door.

If you cannot say with confidence which of your community's devices still carry default credentials, or whether anything beyond signature antivirus is watching them, that uncertainty is the finding. It is worth resolving before an attacker resolves it for you.

Not sure what is running on your community's network?

A one-time security review tells you whether your devices are hardened against this class of threat, which ones still carry default credentials, and where behavioral monitoring is missing. It is a fixed-scope engagement with a clear report at the end.

Request a Security Review