How Darktrace Detects Cryptomining: Threat Example & Walkthrough

Darktrace reports that in July 2025 the company detected and contained a cryptojacking attempt on a retail/e‑commerce network, initiated by a PowerShell payload designed to download and run NBMiner in memory. The initial compromise was observed on July 22 when a new PowerShell user agent was seen contacting an external endpoint, with the desktop device connecting to 45.141.87[.]195:8000 via HTTP and URI infect.ps1.

Analysis showed the infect.ps1 script dropped an AutoIt loader, injected NBMiner into a legitimate process, and then sought Monero mining endpoints, including DNS requests to gulf.moneroocean[.]stream and monerooceans[.]stream before outbound connections to the mining host were blocked by Darktrace’s Autonomous Response.

The response actions prevented the device from making outbound connections within seconds of the initial contact, and Darktrace SOC verified that over 130 connection attempts to the mining endpoint were aborted. This case is highlighted as an example of Darktrace’s anomaly-based detection and autonomous containment, which halted the attack early in the kill chain. according to Darktrace.