Search: “Redis”

25 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Malware 64 Vulnerability 61 Ransomware 35 Exploit / PoC 29 AI tools & infra 16 Industry 14 Threat actor 11 Data breach 10 AI industry 5 Policy & legal 5 AI research 4 Phishing & fraud 2 AI safety & security 2 Model release 2

SeverityAll critical 107 high 67 medium 49 low 12 info 27

Hackers Turn More Than 3,500 Redis Servers Into Cryptocurrency Miners

Hunters.io researchers report 3,562 exposed Redis servers hijacked via replication abuse into Monero cryptomining, causing performance loss and data-integrity risk.

Researchers at Hunters.io exposed a cryptomining operation that compromised 3,562 distinct Redis servers after scanning 12,966 targets. The attackers used unauthenticated Redis instances and master-replica replication to plant a cron task that downloaded and ran XMRig every five minutes. The miner connects to a mining pool over encrypted port 443 and hides among temporary files. Impact includes high CPU usage, elevated cloud bills, and data-loss risk from altered Redis persistence settings.

Cyber Security NewsSep 9, 07:47 UTC · 7d agoMalware in the wild

New Threat: Stealthy HeadCrab Malware Compromised Over 1,200 Redis Servers

The Hacker NewsFeb 3, 03:59 UTC · Feb 3, 2023Malware CVE-2022-0543

‘Worm-like’ botnet malware targeting popular Redis storage tool

The RecordJul 31, 19:32 UTC · Jul 31, 2023Malware CVE-2022-0543

A sophisticated SkidMap variant targets unsecured Redis servers

Security AffairsAug 7, 14:44 UTC · Aug 7, 2023Malware

New Migo Malware Targeting Redis Servers for Cryptocurrency Mining

The Hacker NewsFeb 20, 15:20 UTC · Feb 20, 2024Malware

Novel Worm-Like Malware P2Pinfect Targets Redis Deployments

Infosecurity MagazineAug 1, 17:00 UTC · Aug 1, 2023Malware

New SkidMap Linux Malware Variant Targeting Vulnerable Redis Servers

The Hacker NewsAug 7, 13:50 UTC · Aug 7, 2023Malware

Rust-Based Botnet P2Pinfect Targets MIPS Architecture

Infosecurity MagazineDec 4, 16:30 UTC · Dec 4, 2023Malware

Researchers Raise Red Flag on P2PInfect Malware with 600x Activity Surge

The Hacker NewsSep 21, 12:51 UTC · Sep 21, 2023Malware

Cryptomining Campaign involves Golang malware to target Linux servers

Security AffairsJul 5, 19:27 UTC · Jul 5, 2019Malware CVE-2019-9082 CVE-2019-3396 CVE-2018-7600

PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm

The Hacker NewsMay 7, 17:45 UTC · May 7, 2026Malware CVE-2025-55182 CVE-2025-29927 CVE-2026-1357+2 CVEs

Vulnerable Docker Installations Are A Playhouse for Malware Attacks

Security AffairsMay 6, 10:02 UTC · May 6, 2022Malware

New PumaBot targets Linux IoT surveillance devices

Security AffairsMay 28, 14:01 UTC · May 28, 2025Malware

Kinsing Hacker Group Exploits More Flaws to Expand Botnet for Cryptojacking

The Hacker NewsMay 22, 03:20 UTC · May 22, 2024Malware

WatchBog cryptomining botnet now uses Pastebin for C2

Security AffairsSep 13, 18:04 UTC · Sep 13, 2019Malware CVE-2018-1000861 CVE-2019-11581 CVE-2019-10149+2 CVEs

Modular Cryptojacking malware uses worm abilities to spread

Security AffairsMar 13, 15:16 UTC · Mar 13, 2019Malware CVE-2018-1273 CVE-2017-10271 CVE-2015-1427+1 CVEs

International Operation Disrupts Sality P2P Botnet

US-led international operation with Europol, CrowdStrike, and Shadowserver sinkholed the 20-year-old Sality P2P botnet, once exceeding one million infected machines.

On August 31, 2026, authorities from the US, Bulgaria, Hungary, and Romania, supported by Europol, CrowdStrike, and the Shadowserver Foundation, disrupted the Sality P2P botnet by sinkholing communications and seizing domains. Sality has operated for over 20 years, at its peak controlling more than one million infected machines used for credential theft, spam, proxy services, crypto-theft, and DDoS attacks, with over 11 million unique IP addresses linked to its infrastructure since 2017. The disruption exploited the botnet's super-peer reputation mechanism by removing legitimate peers via protocol-level manipulation and inserting sinkhole entries into emptied peer lists.

Infosecurity MagazineSep 3, 08:30 UTC · 13d agoMalware

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.

Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.

The Hacker NewsAug 15, 00:00 UTC · Aug 15, 2026Malware in the wildCVE-2024-36401