Redis Cryptomining Botnet Compromised 3,562 Servers, Exposed by the Operator's Own Files
An attacker group secretly took over thousands of Redis servers by exploiting weak security settings. They installed cryptocurrency-mining software to steal computing power from those servers without the owners knowing.
- Report priority
- High
- Targets
- cron-injection+3 more
How it works
- The attacker found Redis servers that were set up without passwords.
- They connected remotely and added secret tasks (cron jobs) that ran a hidden Monero miner (XMRig) every time the server restarted.
- The miner used the server's own power to generate cryptocurrency for the attacker, sending profits to a wallet linked to the hacker's own Windows computer.
- The attack worked because the servers were left open to anyone on the internet, not because of a software bug.
What to do
Check if you run Redis on a Linux server. Look for Redis versions 2.8.17 or newer, especially if you never set a password. If you're unsure, search your server logs for unusual tasks running at startup or check if your server's CPU or network usage spikes unexpectedly. If you find hidden tasks or high resource usage, immediately set a strong password for your Redis server if you haven't already.
Update Redis to the latest stable version (7.2.0 or newer) and restart your server. Monitor your server's performance for unusual activity. If you suspect your server was compromised, isolate it from the internet until you've cleaned it. Check your server logs for signs of the miner (XMRig) and remove any suspicious tasks or files.
Technical details
Affected software: cron-injection, misconfiguration, redis, botnet
The attacker scanned the internet for Redis servers with no password. When they found one, they connected, added a hidden task to run a Monero miner, and left it running. Over time, they infected 3,562 servers this way, earning thousands of dollars in stolen computing power.
A cryptomining botnet operator exposed their infrastructure by leaving an unsecured directory at 188.245.99.156, containing 147 files including Python exploit code, campaign logs, and Windows registry backups. The operation targeted unauthenticated Redis servers (versions 2.8.17 through 7.2.0) across Linux distributions, exploiting rogue replication to inject cron jobs running XMRig, a Monero mining tool. The attack affected 3,562 Redis servers out of 12,966 scanned hosts during two campaign runs, demonstrating reliance on misconfiguration rather than version-specific flaws.
Additional files linked to wallet reuse in February 2026 revealed Meterpreter deployment capabilities, extending the operator's activity timeline. Mining was directed to pool.moneroocean.stream using the same wallet used in their own Windows-based control environment.