Researchers discovered an open directory containing the complete Redis cryptomining botnet operator toolkit, including exploit source code, campaign logs, and runtime files. The botnet compromised 3,562 distinct Redis servers out of 12,966 targeted by exploiting unsecured Redis instances with no authentication enabled. The attack used rogue replication commands (SLAVEOF) combined with crafted RDB blobs to drop cron jobs that execute the legitimate XMRig miner over TLS, mining Monero. Attempts to gain SSH access or exploit MongoDB sandbox escapes failed. The attack affects Redis versions from 2.8.17 through 7.2.0, indicating the root cause is insecure configuration rather than a version-specific vulnerability. Mitigation requires enabling requirepass, disabling SLAVEOF/REPLICAOF if replication is unused, or enabling protected-mode. Upgrading Redis versions does not mitigate the issue.

The botnet successfully compromised thousands of Redis servers by exploiting unsecured no-auth configurations, leading to unauthorized cryptomining activity on affected hosts. This results in resource exhaustion and potential operational disruption. No direct exploitation of Redis software vulnerabilities was involved; the impact stems from insecure default or misconfigured Redis instances.

The vendor advises configuring Redis securely by enabling the requirepass directive to enforce authentication, disabling SLAVEOF/REPLICAOF commands if replication is not used, or enabling protected-mode. Since this is a configuration issue, upgrading Redis versions does not mitigate the risk. Administrators should audit Redis instances for no-auth access and apply these configuration changes promptly.