9/5/25, 7:27 PM

On 20 February 2024, researchers from Cado Security Labs (now part of Darktrace) encountered a novel malware campaign targeting Redis for initial access, with the aim of mining cryptocurrency on the underlying Linux host. The campaign, dubbed Migo, is delivered as a Golang ELF binary that uses compile-time obfuscation and can persist on Linux devices, and it includes a modified user-mode rootkit to hide its processes and on-disk artefacts.

Migo disables Redis protections such as protected-mode and replica-read-only during intrusion, then registers a malicious Cron job that fetches its primary payload from transfer[.]sh via Pastebin and executes it in memory. The primary payload installs the XMRig miner, rewrites a default configuration, and configures multiple mining pools with embedded credentials, while also attempting to hide on-disk artefacts by hijacking the dynamic linker and masking files and directories.

It also employs persistence through a systemd timer and service, adjusts system limits, and blocks outbound traffic to selected IPs and cloud-provider domains to hinder monitoring and updates.