CRYPTOMINERS' ANATOMY: SHUTTING DOWN MINING BOTNETS

Summary from the TLDR InfoSec newsletter

Akamai developed two techniques to shut down cryptomining botnets by exploiting mining pool topologies and policies - submitting "bad shares" (invalid hash calculations) that trigger automatic bans from mining pools. The first technique targets mining proxies by connecting as a fake miner and submitting consecutive bad shares, causing the proxy to get banned and shutting down the entire botnet operation (they reduced one campaign's hashrate from 3.3 million to zero). The second technique floods public pools with thousands of fake login attempts to temporarily disrupt direct pool connections, though this method is less permanent than targeting proxies.