A cryptocurrency-mining botnet known as Lemon Duck has been displaying increased activity since the end of August, researchers from Cisco's Talos Intelligence Group say, adding that while defenders would have spotted this activity, it would not have been noticed by end users.