Comment by Gys

> In all the attacks observed, the malware was used to run a cryptominer

I assume it starts by detecting a continuous 100% utilization of the cpu’s.