Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
Source AlienVault OTX General
Description
A cryptomining botnet compromised 3,562 Redis servers by exploiting unauthenticated Redis instances using rogue replication to inject cron jobs that deployed XMRig miners. The affected Redis versions range from 2.8.17 to 7.2.0 across various Linux distributions, indicating misconfiguration rather than a software vulnerability. The attacker toolkit, exposed via an open directory, contained exploit source code, campaign logs, and Windows registry hives. Additional attack vectors targeting WordPress, MongoDB, and SSH were included but did not result in confirmed compromises. The operation mined Monero using a wallet linked to the operator's own systems. Meterpreter deployment capabilities were also observed, extending the operator's activity timeline. No known exploits in the wild or vendor patches are documented.
Impact
The compromise of 3,562 Redis servers enabled unauthorized cryptomining activities that consume system resources and potentially degrade server performance. The exploitation leveraged misconfigured Redis instances lacking authentication, allowing attackers to inject cron jobs and deploy miners. Although other attack vectors were included in the toolkit, no confirmed additional compromises occurred. The presence of Meterpreter capabilities suggests potential for further post-exploitation activities, increasing risk if similar misconfigurations persist. There is no indication of direct data theft or destruction based on the available information.
Defensive guidance
Since the root cause is misconfiguration (unauthenticated Redis instances), remediation involves securing Redis servers by enabling authentication and restricting network access to trusted hosts only. Operators should audit Redis configurations to ensure authentication is enforced and disable or secure replication features to prevent rogue replication attacks. Monitoring for unauthorized cron jobs and removing any deployed miners is recommended. No official patches are indicated as this is not a software vulnerability but a configuration weakness. Patch status is not yet confirmed—check vendor advisories for updates.
MITRE ATT&CK techniques
- T1190Exploit Public-Facing Application · Initial Access (opens in a new tab)
- T1595.002Active Scanning: Vulnerability Scanning · Reconnaissance (opens in a new tab)
- T1053.003Scheduled Task/Job: Cron · Execution, Persistence, Privilege Escalation (opens in a new tab)
- T1059.004Command and Scripting Interpreter: Unix Shell · Execution (opens in a new tab)
- T1574.006Hijack Execution Flow: Dynamic Linker Hijacking · Stealth, Execution (opens in a new tab)
Indicators of compromise
Domains 2
- ayakliborsa.net
- socket.ayakliborsa.net
IP addresses 1
- 213.6.207.123