Oh, thought I'd add one more thing: my rigs run behind a DD-WRT router NAT'd behind a Tomato router, both with very strict policies in place.

This looks more and more like a MITM attack instead of compromised mining software/malware.