The article misses one critical point in these attacks:

practically all these attacks require downloading remote files to the server once they gain access, using curl, wget or bash.

Restricting arbitrary downloads from curl, wget or bash (or better, any binary) makes these attacks pretty much useless.

Also these cryptominers are usually dropped to /tmp, /var/tmp or /dev/shm. They need internet access to work, so again, restricting outbound connections per binary usually mitigates these issues.

https://www.aquasec.com/blog/kinsing-malware-exploits-novel-...