Product

XMRig

2 mentions in 7 days · 3 in 30 days · 3 total · first seen Aug 19, 2026 · last 6d ago

Timeline3 articles

Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners

Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.

Researchers at Hunters.io exposed a cryptomining operation that compromised 3,562 distinct Redis servers after scanning 12,966 targets. The attackers used unauthenticated Redis instances and master-replica replication to plant a cron task that downloaded and ran XMRig every five minutes. The miner connects to a mining pool over encrypted port 443 and hides among temporary files. Impact includes high CPU usage, elevated cloud bills, and data-loss risk from altered Redis persistence settings.

Cyber Security NewsSep 9, 07:47 UTC · 6d agoMalware in the wild 2 sources

Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers

RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.

Hunt.io researchers track a large-scale cryptojacking operation named RedisRaider that scans IPv4 ranges for Redis services exposed on TCP port 6379 and targets instances accepting unauthenticated connections. From a master list of 12,966 candidate hosts, 2,342 were confirmed to accept commands without authentication. Attackers abuse Redis commands (CONFIG SET dir/dbfilename, SET, BGSAVE) to write malicious cron entries into /etc/cron.d or /var/spool/cron, launching XMRig-based Monero miners, with branches including SSH authorized-key injection, Lua probing, and WordPress spraying. The article also references CVE-2026-81934, a Redis TLS use-after-free allowing unauthenticated command execution, fixed in releases including 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.

GBHackersupdated Sep 9, 07:47 UTC · 6d agofirst Sep 9, 05:28 UTC · 6d agoExploit / PoC in the wild 2 sources CVE-2026-81934

Eleethub: A Cryptocurrency Mining Botnet with Rootkit for Self

Unit 42 uncovered Eleethub, a Perl-based Bitcoin mining botnet using a crafted rootkit and libprocesshider to evade detection, still under development with few infections.

Unit 42 discovered an under-development Perl Shellbot campaign that mines Bitcoin using xmrig and emech while evading detection via a rootkit that replaces the ps tool and the LD_PRELOAD-based libprocesshider.so library. Infected devices download a malicious shell script, connect to IRC-based C2 at eleethub.com and the UnderNet network, and can receive commands for UDP/TCP floods, port scans, and HTTP attacks. The botnet can affect Unix systems and Windows 10 hosts running a Linux subsystem, and its operators use the 'Los Zetas' branding, though they are unlikely to be the Mexican drug cartel. Researchers found only a few compromised 'zombies' before the campaign expanded.

Palo Alto Unit 42Aug 19, 12:05 UTC · 27d agoMalware in the wild

Related CVEsby mentions

CVE-2026-819347.5<1%
Use-After-Free in Redis TLS Pending-Data Handling Enables Unauthenticated RCE
Redis contains a use-after-free flaw (CWE-416) in the tlsProcessPendingData() function, which manages the TLS pending-data list, and it affects only deployments that are configured with TLS support. A remote, unauthenticated attacker who can reach the TLS-enabled Redis service can trigger the flaw; the CVSS 4.0 vector scores it as high attack complexity with present attack requirements, suggesting timing- or condition-dependent exploitation. Successful exploitation may allow the attacker to execute arbitrary commands with the privileges of the Redis server process. Any Redis installation running with TLS enabled is in scope, though affected version ranges are not specified in the available data. No public proof-of-concept exists and the flaw is not in CISA KEV (EPSS 0.4%), but related headlines note a massive Redis cryptojacking campaign hijacking thousands of Linux servers, so Redis deployments are actively targeted in the wild even if this specific flaw's exploitation is not yet confirmed.
· Redis (open-source in-memory database server)mass

Appears with

malware XMRig 2 vendor Redis 2 product Redis 2 malware Perl Shellbot 1 organization Elastic 1 organization Hunters.io 1 organization Hunt.io 1 organization UnderNet 1 organization Unit 42 1 product emech 1 product libprocesshider.so 1 vendor Elastic 1 vendor Hunt.io 1 vendor Palo Alto Networks 1 threat actor Los Zetas 1 vendor XMRig 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.