Threats Tagged 'rogue-replication'

A cryptomining botnet compromised 3,562 Redis servers by exploiting unauthenticated Redis instances using rogue replication to inject cron jobs that deployed XMRig miners. The affected Redis versions range from 2.8.17 to 7.2.0 across various Linux distributions, indicating misconfiguration rather than a software vulnerability. The attacker toolkit, exposed via an open directory, contained exploit source code, campaign logs, and Windows registry hives. Additional attack vectors targeting WordPress, MongoDB, and SSH were included but did not result in confirmed compromises. The operation mined Monero using a wallet linked to the operator's own systems. Meterpreter deployment capabilities were also observed, extending the operator's activity timeline. No known exploits in the wild or vendor patches are documented.