We have come across these Monero-mining malware instances where they, interestingly, seem to be coded to not use more than 60% of the CPU, meaning they largely go undetected for weeks, if discovered at all. Most capacity-management tools are configured to alert from 90% upwards. It is curious that the variants mentioned in this article seem to consume as much CPU as possible; seems rather counter productive.