Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners
Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.
Researchers at Hunters.io exposed a cryptomining operation that compromised 3,562 distinct Redis servers after scanning 12,966 targets. The attackers used unauthenticated Redis instances and master-replica replication to plant a cron task that downloaded and ran XMRig every five minutes. The miner connects to a mining pool over encrypted port 443 and hides among temporary files. Impact includes high CPU usage, elevated cloud bills, and data-loss risk from altered Redis persistence settings.
- 3,562 distinct Redis servers compromised from 12,966 scanned targets.
- Abused master-replica replication and cron to fetch XMRig Monero miner.
- Affected Redis 2.8.17-7.2.0; misconfiguration, not a CVE, was the issue.
- Hunters.io found an exposed operator directory with 147 files including logs.
- Defenders urged to require Redis auth, restrict REPLICAOF, and inspect cron dirs.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1053.003 Scheduled Task/Job: CronT1105 Ingress Tool TransferT1036.005 Masquerading: Match Legitimate Name or LocationT1098.004 Account Manipulation: SSH Authorized Keys
- Malware
- XMRig
- Organizations
- Hunters.io
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | socket.ayakliborsa.net | pool endpoint used by botnet-deployed XMRig Domain and port socket.ayakliborsa.net:8081 Live operator-controlled hostname resolving to 188.245 |
| ipv4 | 173.212.244.25 | IP addresses 34.166.99.116 , 20.198.10.42 , 213.6.207.123 , 173.212.244.25 Additional observed development and QA targets IP address 2 |
| ipv4 | 188.245.99.156 | f compromise (IoCs):- Type Indicator Description IP address 188.245.99.156 Operator host used for rogue Redis replication, command-and |
| ipv4 | 194.48.248.105 | Recurring WordPress exploitation target IP address and port 194.48.248.105:8081 Earlier open directory linked by cryptocurrency wallet |
| ipv4 | 20.198.10.42 | target, ownership unconfirmed IP addresses 34.166.99.116 , 20.198.10.42 , 213.6.207.123 , 173.212.244.25 Additional observed develo |
| ipv4 | 213.6.207.123 | hip unconfirmed IP addresses 34.166.99.116 , 20.198.10.42 , 213.6.207.123 , 173.212.244.25 Additional observed development and QA tar |
| ipv4 | 23.235.223.49 | 5 Additional observed development and QA targets IP address 23.235.223.49 Recurring WordPress exploitation target IP address and port |
| ipv4 | 34.166.99.116 | eused QA or test target, ownership unconfirmed IP addresses 34.166.99.116 , 20.198.10.42 , 213.6.207.123 , 173.212.244.25 Additional |
| ipv4 | 45.155.102.89 | stname> Victim check-in request pattern IP address and port 45.155.102.89:10128 Local mining pool proxy used on the operator host Dom |
| ipv4 | 47.250.92.230 | -controlled hostname resolving to 188.245.99.156 IP address 47.250.92.230 Frequently reused QA or test target, ownership unconfirmed |
| sha256 | 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a | identifier observed in the RDP certificate TLS fingerprint 420c7850e09b7c2b9e39e2a93e204e3c56bcf08a685ff1daa986e3c348da5d2a Pinned mining-pool certificate fingerprint in the newest pa |
From the original article
4 min read at cybersecuritynews.com
A large cryptomining operation has compromised 3,562 Redis servers and turned their processing power into a source of Monero revenue. The campaign did not rely on a newly discovered software flaw. Instead, it targeted internet-facing Redis instances that accepted commands without authentication.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.