Preventing and Removing Viruses, Malware, and Remote Attacks on ANTMINER

Hardening an Antminer comes down to four things: change the default root / root login, keep the miner’s web and SSH ports off the open internet, run only official signed firmware, and watch your pool worker names for tampering. The malware that hits home and hashcenter miners rarely “damages” hardware — it quietly rewrites your pool and worker configuration so your hashrate credits someone else’s account. A stock miner with factory credentials on a flat, internet-reachable network is the entire attack surface. This guide is the prevention layer; if a unit is already compromised, jump to the detection and removal guides linked at the end.

How Antminers Actually Get Compromised

These infections are opportunistic, not targeted. The common vectors are boringly consistent:

• Default credentials. Every new or factory-reset Antminer ships with username root and password root. A worm that finds an open web UI or SSH port simply logs in.
• Exposed management ports. A miner reachable from the public internet — directly, or through a router with port 80 (web UI) or port 22 (SSH) forwarded — is scannable by anyone.
• Sideloaded firmware. “Free overclock” or “unlocked” firmware pulled from a forum or a random download is the classic delivery mechanism. It also voids your warranty on the spot.
• Lateral spread. Once one unit is infected on a flat LAN, it scans its neighbours and reuses the same default login to spread across the whole fleet.

The payoff is almost always pool and worker hijacking: your configured pool URL, worker name, or the wallet behind it gets swapped so the machine keeps hashing but pays out to the attacker.

Step 1 — Kill the Default Credentials

This is the single highest-value change, and it is free. On a new or reset miner the login is root / root, and every worm knows it.

1. Open the miner’s web UI in a browser at its LAN IP address and log in with root / root.
2. Go to System → Administration (labelling varies slightly by model and firmware).
3. Set a long, unique password — not a farm-wide reused string. When the status reads Updating Password, it has taken.
4. Record it somewhere durable. On stock firmware there is no “forgot password” flow: if you lose it, your only recovery is an SD-card or serial reset back to root / root, which throws you back to square one.

Managing more than a handful of units, change them in bulk. Bitmain’s APMinerTool (v1.0.7) sets a new password across every miner it discovers on the LAN in one pass. Do it before any unit touches a shared network.

Step 2 — Isolate the Mining Network

A miner has no business being reachable from the internet. Its web UI and SSH interfaces are management surfaces, not public services.

• Never port-forward to a miner. Do not expose ports 22, 80, or 443 of any Antminer through your router. If you need remote access, reach the network over a VPN and manage the miner from inside.
• Segment the fleet. Put miners on their own VLAN or a dedicated subnet, separate from PCs, phones, and the household/office LAN. This contains lateral spread — an infected laptop can’t reach the miners, and one poisoned miner has fewer neighbours to jump to.
• Firewall outbound too. Miners only need to reach your configured pool(s), NTP, and DNS. Blocking arbitrary outbound connections at the gateway breaks the callback path many of these worms rely on.
• Lock down the management PC. The Windows box running APMinerTool or the antivirus utility sits on the mining network by necessity — keep it patched, keep it clean, and don’t browse the wider web from it.

Step 3 — Firmware Hygiene

Firmware is the crown jewels. Compromise it and everything above is moot.

• Official signed images only. Flash firmware exclusively from the manufacturer’s own portal for your exact model. Do not sideload builds from forums, chat groups, or file-share links — that is how infections arrive in the first place.
• Treat “overclock/unlock” firmware as hostile. Unauthorized firmware for S9/T9-class and later miners voids the warranty immediately and is the most common malware carrier. If you want legitimate tuning, use signed firmware from a vendor you trust.
• Keep firmware current. Newer stock releases close known holes. Bitmain’s later “secure firmware” builds actively shut the SSH port (22) after flashing, which removes one of the primary entry points entirely.

Step 4 — Monitor and Detect

Prevention is not a one-time event. Build a habit of looking for the early signs:

• Watch your pool side. The clearest tell is a mismatch — the miner reports full hashrate locally, but your pool account shows a worker missing, renamed, or hashing less. Unknown workers appearing under your account is a red flag.
• Audit pool/worker config periodically. Confirm the pool URLs and worker names in each miner still match what you set. Silent edits to that config are the whole point of the attack.
• Scan on a schedule. Run Bitmain’s antivirus utility across the fleet from your management PC to flag any unit reporting Poisoned. A unit already on secure firmware with SSH closed will report as such — that is the state you want.

If a Unit Is Already Infected

Hardening protects clean machines; it does not clean a dirty one. If a miner is mining to a pool you never configured, or a scan flags it as poisoned, treat it as compromised:

1. Quarantine it. Pull it off the shared network so it can’t scan or reinfect its neighbours.
2. Factory-reset and reflash. Reset to factory settings and reflash the latest official firmware — via the web UI where the unit is still reachable, or via SD-card / serial recovery where it is not. This is the only way to be sure the payload is gone.
3. Set a strong password before it rejoins the network, since the reset returns it to root / root.

Detailed detection tooling is covered in the Bitmain antivirus software instructions, and the full recovery methods — batch tool, SD-card, and serial-port SD recovery per model — are in the Antminer anti-virus treatment guide.

Common Mistakes

• Leaving one miner on defaults “just for testing.” That one unit is the beachhead for the whole fleet.
• Forwarding the web UI for remote access. Use a VPN into the network instead — never expose the miner directly.
• Reusing one password across every unit. Convenient for you, convenient for a worm that cracks one.
• Chasing free overclock firmware. It voids the warranty and is the single most common infection route.

Related: Once your fleet is hardened, keep the rest of your maintenance tight — brush up on what miner firmware is and how it’s signed, and if a board needs hands-on attention beyond a reflash, you can start a repair with D-Central.