A systems administrator notices that several application servers are running at nearly 100% CPU utilization during off-peak hours when workloads are normally minimal. Investigation reveals unfamiliar processes making outbound connections to a mining pool address, and the servers' cooling fans are running constantly. No legitimate batch jobs are scheduled at these times. Which indicator of malicious activity best describes what the administrator observed?