Follow the Payload · 1 — The Miner: Compute as the Prize

Follow the Payload — Case 1. This register takes what an intruder leaves behind and reads it for the one thing it cannot hide: its purpose. Closing each case on the objective the payload serves: STEAL COMPUTE · STEAL BANDWIDTH · RECRUIT · STEAL DATA · EXTORT · PERSIST.

Three registers have come before this one, and each read a different face of an intrusion. Follow the Money read the intruder's motive as an economic abstraction — why, in the language of markets and profit. Follow the Access read the vector — how he got in. Follow the Operator read the hand — who he was, or as near to it as evidence allows. This register reads the thing all three circled but none looked at directly: what he left. The payload — the binary or script he dropped and ran on the compromised host — is the intrusion's residue, and it carries a property none of the other faces carry so plainly. A motive must be inferred; a hand must be attributed; but a payload's purpose is executable. It does one specific thing when it runs, and that thing is its intent, made concrete, made testable, made undeniable. To read the payload is to read the objective more directly than to read the actor, because the actor can lie about what he wanted and the payload cannot — it simply does what it does.

The register opens where intrusions most often open: on a cryptocurrency miner. It is the most common thing an intruder leaves behind, and it is also the clearest, which is why it is the right first case. A miner's purpose is not a puzzle. It exists to spend the host's processor on proof-of-work, to submit the results to a mining pool, to credit a wallet the operator controls — and every part of it says so, from the binary that is a known miner to the config file naming a pool and a wallet to the host itself, its CPU pinned at the ceiling, grinding out hashes for someone else's benefit. There is nothing to interpret. The objective is written on the artifact and confirmed by the machine, and it is STEAL COMPUTE. This case reads that objective, and in reading it, lays down the frame and the discipline that the twenty-five cases after it will inherit: the payload is the purpose made executable — and the payload names what, far more loudly than it names who.

1. The Payload Is the Purpose Made Executable

Begin with the frame, because it is what makes this register different from the three before it. An intrusion, viewed as evidence, has several faces, and each prior register chose one. The motive register asked why and answered in abstractions — profit, espionage, disruption — that had to be argued from circumstance, because motive is a state of the actor's mind and minds are not directly observable. The attribution register asked who and answered with invariants — the reused key, the persistent behavior — that had to be corroborated, because identity is inferred from traces and traces can mislead. Both registers dealt in inference: they reasoned from evidence toward a conclusion the evidence did not contain outright.

The payload is different in kind, because a payload does not have to be inferred — it can be run. It is intent that someone compiled into an artifact, and an artifact, unlike a motive or an identity, has a behavior you can observe directly: put it in a sandbox, or watch it on the host, and it does its purpose in front of you. A miner mines. A ransomware encrypts. A backdoor listens. The purpose is not a hypothesis about the payload; it is a property of the payload, as readable as the payload's size or its hash, because the purpose is what the payload was built to do and the payload does it whether or not anyone is watching. This is the register's foundational advantage: where the motive register argued toward intent and the attribution register argued toward identity, the payload register can observe intent, because intent is what the payload executes.

And this is why the payload cannot lie about its purpose the way an actor can. An intruder can claim any motive — can pose as an activist, a researcher, a rival — and the claim is just words, checkable only against his behavior. His payload has no such freedom. A binary built to encrypt files will encrypt files; it cannot say it is a research tool and then behave as one, because its behavior is fixed in its code. The payload is the actor's intent stripped of the actor's ability to spin it — the one place in the intrusion where purpose is not a story but a function. To read the payload is therefore to read the intent at its most honest, because the payload is the intent that got committed, compiled past the point where it could be dressed up as something else. The register reads that committed intent, and the miner is where committed intent is clearest.

2. Why the Miner Is the Clearest Reading

The miner earns the first case because it is the payload whose intent is least ambiguous, and its clarity rests on two conditions that the register will return to in every case: the miner's function is unambiguous, and the miner was executed.

Take unambiguity first. A miner does exactly one thing: it mines. There is no second interpretation, no dual-use reading, no "perhaps it is a legitimate tool." A cryptominer is a cryptominer; its whole design is proof-of-work computation aimed at a pool, and nothing about that design serves any purpose but mining. This matters because many payloads do admit second readings — a network tool might be administration or exfiltration, a script might be maintenance or sabotage — and reading their intent requires disentangling the innocent interpretation from the malicious one. The miner spares the register that work. Its function is single-valued: whatever else is uncertain about the intrusion, the presence of a running miner means the objective includes compute theft, with no interpretive gap to bridge. The binary is a miner, miners mine, and mining is the theft of the host's compute. The chain has no weak link.

Now execution, which is the stronger of the two conditions. A payload that merely arrived on the host — sitting on disk, never run — tells you what its author was prepared to do, but not what he did; the intent is latent, a capability not yet an act (a distinction the register will devote a whole later case to). A miner caught in the act is past that threshold. The honeypot does not merely find a miner binary; it observes the effect: the CPU pinned near 100%, the outbound connection to the pool, the wallet accumulating credit. The intent is not inferred from a dormant file; it is confirmed by observed behavior, the payload doing its purpose in view. Unambiguous-and-executed — a function that can only mean one thing, and evidence that the thing was done — is the gold standard of intent-reading, the combination that lets the register close on HIGH. The miner meets it plainly, which is why STEAL COMPUTE reads at HIGH here and why the register opens on it: it is the case where reading intent is easiest, so it is the case that best shows what reading intent is.

And note what the miner does for a claim the money register could only argue. That register had to infer that an intrusion was profit-motivated, reasoning from circumstance to a motive it could not see. The miner renders the inference unnecessary: it is the profit motive, executing. The abstract "make money from this machine" is compiled here into a binary that makes money from this machine — by a named mechanism (proof-of-work), for a named beneficiary (the wallet), at a measurable rate (the hashrate on the pinned CPU). The payload register does not argue that the objective was compute-theft-for-profit; it watches the machine do it. That is the whole difference between reading a motive and reading a payload — the motive is a claim about the mind, the payload is a fact about the machine.

3. The Host Is the Victim

A defining feature of STEAL COMPUTE, and one that will distinguish it from most objectives to come, is where the harm lands: the victim of a miner is the host it runs on. The resources the miner consumes — the CPU cycles, the electricity, the hardware lifespan worn down by sustained full load, the cloud bill run up by metered compute — all belong to the compromised machine itself. The miner's product, the currency it credits to the operator's wallet, is extracted from the host's own resources, converted directly out of the victim's electricity and silicon into the attacker's coin. There is no third party in the loop, no downstream target, no other victim to disentangle. The intent begins and ends at the host.

This locality makes STEAL COMPUTE the cleanest objective to reason about, and the register dwells on it precisely because later objectives will not share it. A residential-proxy payload turns the host into an exit node for other people's traffic — the host is a tool, but the victims are the parties that traffic targets or defrauds. A DDoS payload turns the host into a weapon aimed at a third party — the host is complicit, but the victim is elsewhere. A propagation payload uses the host to reach the next host — the current victim is a stepping-stone to future ones. Each of these splits the harm between the host and someone else, and reading their intent means reasoning about a target beyond the machine in hand. The miner has no such split. Its harm is entirely local, its victim entirely the host, its objective entirely contained. The register establishes this here as a baseline: STEAL COMPUTE is the objective where the payload's whole purpose is consummated on the machine it infected, and every later objective will be defined partly by how it departs from that containment.

4. Intent Loud, Author Silent

Here the register plants the discipline that will run through all twenty-six cases, and the miner is the perfect vehicle for it because it exhibits the split at its most extreme. The payload's intent-confidence and its author-confidence are different quantities, and they must never be confused. The miner names the objective at HIGH — compute theft, unambiguous and executed. It names the operator at almost nothing. And the reason is a single word: commodity.

A cryptominer is commodity software. The dominant one, XMRig, is public, free, open-source, and universal; its variants are downloaded and dropped by countless unrelated intruders, from bored teenagers running exploit kits to organized crews monetizing scanned exposures at scale. The same binary, byte-for-byte or near it, appears on compromised hosts all over the world, deployed by people who have nothing to do with one another and share only the objective of turning a stolen machine into coin. So the presence of that binary links its deployer to no one in particular. It says, loudly and reliably, "someone's objective here was compute theft"; it says nothing about whose objective, because the objective is pursued by a multitude using the identical tool. The miner is a signal about what and a near-silence about who.

This inverts, exactly, the caution the attribution register spent twenty-six cases teaching, and the inversion is worth stating precisely because it defines the two registers' relationship. In Follow the Operator, the danger was that an artifact would over-imply a shared identity — that a shared key or shared tool would be read as "same hand" when it might be a leak or a coincidence, so the register had to discount the artifact's implication about who. Here the danger runs the other way: a commodity artifact under-implies identity almost to zero, but it reliably implies a shared objective, and the temptation is to let the artifact's silence about the author contaminate its clarity about the intent — to think "this tells us nothing, it is just a commodity miner" and miss that it tells us the objective with certainty. The discipline is to hold the two apart: read the intent, which the commodity payload delivers at HIGH, and decline the author, which the commodity payload cannot support at all. The payload is loud about what and silent about who, and a register that reads it well hears both the sound and the silence for what each is.

5. The Loud Payload as a Marker

For the defender, the miner's most useful property is the one that makes it least sophisticated: it is loud. A miner cannot hide and still do its job, because its job is to maximize hashrate, and maximizing hashrate means running the CPU flat out, which is the single most detectable thing a process can do. It also must reach its pool, an outbound connection to a known mining destination, and it must carry a config naming that pool and wallet. Every one of these is trivial to detect — the pinned CPU on a monitoring graph, the pool connection in network logs, the known binary on disk — because the miner is not built for stealth; stealth would cost it the very throughput it exists to produce. The cheapest objective is deployed by the least careful intruders using the loudest possible tool, and catching it is correspondingly cheap.

But the register insists the miner be read as more than a nuisance to clean, because its loudness carries a message. A miner on a host is proof that the host was exploitable enough for a low-effort, commodity intruder to find, breach, and monetize — the bottom of the attacker market, the opportunist running mass exploits against whatever answers. And an exposure that the bottom of the market can walk through is an exposure that the top of the market can walk through too. The same open door that let a teenager drop a public miner would let a serious operator drop a backdoor, a proxy, a data-harvester — a quieter payload with a costlier objective. So the miner is a marker: the canary that signals not just "you have a miner" but "you have a door," and the door is the finding that matters. Clean the miner, yes — but read it as the cheapest possible confirmation that the host was open, and treat the openness, not the miner, as the real event. The loudest payload is often the most valuable diagnostically, precisely because its presence is the free, unmistakable proof of an exposure that a subtler payload would have exploited silently.

The honest close is that the miner is the register's easiest case and therefore its best opening, because it shows the method working under ideal conditions before the conditions get hard. Here the function is unambiguous, the execution is observed, the objective is HIGH, the author is honestly declined, and the harm is cleanly local — every part of the reading is clean. The cases to come will each remove one of these comforts: payloads whose function is dual-use, payloads that never ran, payloads that lie about their objective, payloads with no single objective at all, payloads that are not even payloads. The miner is where the register establishes what a clean reading looks like, so that the messy readings later can be measured against it. The vectors do not lie about what they do: this one mines, so its objective is compute theft, and we read that objective at HIGH and name no author it cannot support. We do not judge the hand we cannot see. We read the payload, we name the purpose it executes, and we let people judge.

6. The counter-narrative, steelmanned

The strongest objection to opening on the miner — and to reading its objective as the objective — is that the miner is exactly the payload a competent intruder would use as a decoy: drop a loud, obvious, cheap miner to pin the CPU and light up every monitor, precisely so that the defender, satisfied he has found the intrusion, cleans the miner and stops looking — while the real payload, a quiet backdoor or a slow data-harvester, does its work unnoticed behind the noise. On this view, reading the miner's loud objective as the intrusion's objective is not just incomplete; it is walking into the trap the miner was placed to set, and the register's clean HIGH reading is precisely the over-confidence the intruder was counting on.

The objection is sharp because the tactic is real and the psychology is sound. Attention is finite, and a loud, unambiguous, satisfying find — a pinned CPU, a known miner, a clear objective — is exactly the kind of thing that closes an investigation, because it feels like a complete answer. An intruder who understands defenders knows that a found miner reads as "intrusion located, objective identified, remediation obvious," and knows that this feeling of closure is the most effective cover there is, better than stealth, because it does not evade the search — it ends the search, by giving the searcher a reason to stop. A register that reads the miner as the whole story hands the intruder that closure, and the cleaner and more confident the miner-reading, the more completely the decoy works.

The register concedes the tactic entirely and answers that it reads the payload stack, not a payload, and that the loud miner is precisely the prompt to look for the quiet companion — its obviousness a reason to search further, never a reason to stop. The concession is the point: nothing in the miner's HIGH reading claims the miner is the only payload, and a later case is devoted entirely to the layered intrusion, where several payloads with different objectives coexist and the objective is plural. Reading STEAL COMPUTE at HIGH is a claim about this payload — that its purpose is compute theft, unambiguously and executed — and it is true whether or not a second payload exists; the miner really does mine, and that reading does not become false because something else is also present. What the objection correctly attacks is not the reading but a further inference the register never makes: "the miner is the objective, therefore the intrusion is fully understood." The register does not make that inference, because the frame that opens this case — the payload is the purpose made executable — is stated in the singular for the payload, not the intrusion, and an intrusion may commit several payloads, each with its own purpose to be read. And the decoy tactic, far from defeating the register, is anticipated by it: the miner as a MARKER (section 5) is exactly the discipline that answers the decoy, because reading the miner as a marker of a door rather than an account of the intrusion is precisely the instruction to treat the loud find as the beginning of the search — "the host was open, so what else came through the open door?" — and not its end. The intruder's trap depends on the miner producing closure; the register's marker-reading denies it closure, converting the loud find from a reason to stop into a reason to keep looking. So the objection identifies a real trap and the register's own method disarms it: read this payload's objective at HIGH because it is true, refuse to promote "this payload" to "the intrusion," and treat the loudest artifact as the canary that opens the investigation rather than the confession that closes it. The miner's obviousness is not the register's blind spot; it is the register's first clue.

7. Objective Signal — STEAL COMPUTE

Case 1 opened the register on the most common payload and the clearest reading of intent it affords. The frame: the payload is the purpose made executable. Where the motive register inferred why and the attribution register attributed who, this register reads what the intruder left — the payload — for the one property it cannot hide, its purpose, because a payload's purpose is not inferred but executed: it does one specific thing when run, and that thing IS its intent, committed past the point where it could be dressed up as something else. To read the payload is to read intent at its most honest, and the miner is where honest intent is clearest.

The miner reads at HIGH on two conditions the register will demand of every high reading: its function is UNAMBIGUOUS (a miner only mines — no dual-use interpretation) and it was EXECUTED (the host shows CPU pinned near 100%, an outbound pool connection, a wallet in the config — the payload did not merely arrive, it ran and did its work in view). Unambiguous-and-executed is the gold standard of intent-reading. The objective is STEAL COMPUTE, and its victim is the HOST ITSELF — its cycles, power, lifespan, and cloud cost converted directly into the operator's coin, with no third-party target to disentangle, a locality that later objectives (proxy, DDoS, propagation) will lack and be defined by lacking. The miner is also motive-made-concrete: where the money register had to infer a profit motive, the payload register reads it off the running miner, which IS the profit motive executing — named mechanism (proof-of-work), named beneficiary (the wallet), measurable rate (the hashrate).

The counter-discipline, planted here for all twenty-six cases: intent-confidence and author-confidence are different, and must never be confused. The miner names the OBJECTIVE at HIGH and the OPERATOR at almost nothing, because miners are COMMODITY — the same public XMRig binary is dropped by thousands of unrelated intruders, so it implies a shared objective while implying nothing about a shared hand. This inverts the attribution register's caution (there a bespoke artifact over-implied a shared identity; here a commodity artifact under-implies identity but reliably implies intent). Read the intent, not the author — the payload is loud about WHAT and silent about WHO. Defensively the miner is loud (it cannot hide without cutting the hashrate that is its whole point), hence a cheap catch and a MARKER: a detected miner proves the host was exploitable enough for a low-effort commodity intruder, therefore exploitable enough for a higher-effort one — the canary signalling a door more dangerous payloads could also have used. The steelmanned objection — that the miner is a decoy dropped to produce closure and hide a quieter payload — is answered by the register reading the payload STACK not a single payload (the frame is singular for the payload, not the intrusion), and by the marker-reading being precisely the instruction to treat the loud find as the beginning of the search, not its end: the miner's obviousness is the register's first clue, not its blind spot. No individual named — the objective is named, the commodity author declined. Classification: TLP:WHITE. We read the payload, we name the purpose it executes, and we let people judge.

Follow the Payload — Case 1. Objective signal: STEAL COMPUTE. Confidence: HIGH for the objective (unambiguous function — a miner only mines — plus executed effect: CPU pinned near 100%, outbound pool connection, wallet in the config, the payload observed doing its work); LOW for the author (the miner is COMMODITY — a public XMRig-class binary dropped by thousands of unrelated intruders, so it implies a shared objective and no shared hand). THE FRAME (register-opening): the payload is the purpose made executable — a payload's purpose is not inferred like a motive or attributed like an identity but EXECUTED, observable directly (unambiguous + executed = the gold standard of intent-reading), and it cannot be dressed up as something else the way an actor's claimed motive can. The miner is the archetype and the clean baseline: motive-made-concrete (the profit motive executing — proof-of-work, wallet, hashrate), victim = the HOST ITSELF (compute/power/lifespan, no third-party target, a locality later objectives lack). THE COUNTER-DISCIPLINE (planted for all 26 cases): intent-confidence ≠ author-confidence — read the intent (HIGH), not the author (near-zero for a commodity payload); inverts the attribution register's caution. Defensively the miner is LOUD (cannot hide without cutting its hashrate) — a cheap catch and a MARKER of exposure (the canary: a door the bottom of the market walked through, so the top could too). Steelmanned objection (the miner is a DECOY dropped to produce investigative closure and hide a quieter payload) is answered by reading the payload STACK not a single payload (the frame is singular for the payload, not the intrusion — Case N handles plural objectives) and by the marker-reading treating the loud find as the START of the search, not its end. No individual named — objective named, commodity author declined. Classification: TLP:WHITE. Include everything — the miner mines, so its objective is compute theft; we read the intent, name the objective, and decline the author the commodity artifact cannot support.