SecuritySecurity track
Cryptojacking on GPU clusters
Read it in Chapter 6 · checkpoint +50 XP →
Unauthorized cryptocurrency mining on stolen GPU time: the most common way GPU clusters get abused.
GPUs are valuable, and attackers who get code execution on a GPU node very often just mine cryptocurrency. Common entry points:
- Exposed, unauthenticated services: notebooks, dashboards and ML tooling UIs on
0.0.0.0(see Exposed notebooks & dashboards). - Leaked credentials and API keys in images, repos or job scripts (see Supply chain & secrets).
- Over-privileged containers.
Detection signals
- A GPU busy with no scheduled job: compare DCGM utilization to scheduler state.
- Unknown process names on GPUs (
nvidia-smi), often disguised as kernel threads. - Outbound connections to mining pools (stratum protocol, ports like 3333/4444) in
ss -tnpor firewall logs. - New cron entries or systemd units owned by unexpected users.
Response: preserve evidence → kill the process → remove persistence → close the entry point → lock or rotate the affected identities → look for lateral movement → report. Killing the process alone is never enough. The Night Shift mission makes that concrete.
Use it in a mission
Security
Night Shift
A GPU is busy with no job scheduled. Investigate, contain and remove persistence.
Related
Sources & further reading
Written for LazyLab in our own words; sources are cited for depth and verification.