Massive Redis Cryptojacking Campaign Hijacks Thousands of Linux Servers
RedisRaider cryptojacking campaign compromises thousands of exposed, unauthenticated Linux Redis servers using cron persistence to deploy XMRig Monero miners.
Hunt.io researchers track a large-scale cryptojacking operation named RedisRaider that scans IPv4 ranges for Redis services exposed on TCP port 6379 and targets instances accepting unauthenticated connections. From a master list of 12,966 candidate hosts, 2,342 were confirmed to accept commands without authentication. Attackers abuse Redis commands (CONFIG SET dir/dbfilename, SET, BGSAVE) to write malicious cron entries into /etc/cron.d or /var/spool/cron, launching XMRig-based Monero miners, with branches including SSH authorized-key injection, Lua probing, and WordPress spraying. The article also references CVE-2026-81934, a Redis TLS use-after-free allowing unauthenticated command execution, fixed in releases including 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.
- Campaign relies on misconfiguration and native Redis commands, not a software exploit
- CONFIG SET and BGSAVE abused to plant cron files that persist across Redis restarts
- 2,342 of 12,966 scanned hosts accepted commands without authentication
- IOCs include 188.245.99.156 as C2 and pool.moneroocean.stream as mining pool
- Defenders advised to patch CVE-2026-81934 and harden exposed Redis instances
- CVEs
- CVE-2026-81934
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1046 Network Service ScanningT1053.003 CronT1496 Resource HijackingT1098.004 SSH Authorized Keys
- Threat actors
- RedisRaider
- Malware
- XMRig
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-81934 | Use-After-Free in Redis TLS Pending-Data Handling Enables Unauthenticated RCE | 7.5 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | moneroocean.stream | ocal mining pool/proxy used by the operator’s own host pool.moneroocean[.]stream:443 Domain:port Mining pool used by botnet-deployed XMRig |
| ipv4 | 188.245.99.156 | er infrastructure-abuse operation. IOCs Indicator Type Role 188.245[.]99.156 IP Operator host — rogue Redis endpoint, C2, payload stag |
| ipv4 | 45.155.102.89 | 156:16379–16385 IP:port range Rogue Redis replication ports 45.155[.]102.89:10128 IP:port Local mining pool/proxy used by the operato |
From the original article
4 min read at gbhackers.com
A large-scale Redis cryptojacking operation targets thousands of exposed Linux servers by abusing unauthenticated Redis deployments to install XMRig cryptocurrency miners and establish durable, cron-based persistence. The campaign scans IPv4 address ranges for Redis services exposed to the internet, typically on TCP port 6379, then attempts to interact with instances that allow connections without authentication. […]
By Mayura Kathir · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.