RESEARCHERS from Hunt[.]io uncovered a Redis-based cryptomining operation that compromised 3,562 internet-facing Redis servers, largely on APAC cloud hosts. The attacker used a rogue replication method to point victims at a fake Redis master, delivering a crafted data file that was written to disk without exploiting a software bug or bypassing authentication. The operation’s own logs indicated eight years of vulnerable deployments, with Redis versions ranging from 2.8.17 to 7.2.0.
A cron job was created to run every five minutes, downloading XMRig from the official GitHub page and starting Monero mining on each host. The miner then connected to a public Monero pool over port 443 using TLS, while a separate HTTP heartbeat to a Python C2 service reported host liveliness and was logged locally by the operator. The same Monero wallet appeared across all payloads, linking the botnet’s gains directly to the operator’s workstation.
Defence guidance, as outlined by the researchers, emphasises preventing exposure: do not expose Redis to the public internet, bind it to localhost or a private network, require authentication, and enable protected mode on all instances. Disable dangerous commands such as CONFIG, SLAVEOF, and REPLICAOF, and watch for unusual replication events. Audit cron directories and other common footholds, since the operator built multiple persistence surfaces.
Indicators of compromise include hidden miners in temporary directories and outbound TLS traffic to a known Monero pool. Blocking mining pool domains at the network edge can add a useful defence layer; the campaign illustrates that deployment misconfigurations, not software flaws, continue to drive cryptominer campaigns.