Redis Cryptomining Botnet Hijacks 3,562 Servers for Monero
A botnet hijacked thousands of Redis servers to secretly mine Monero cryptocurrency. Attackers tricked the servers into connecting to their own command-and-control network.
- Report priority
- Medium
How it works
- Attackers sent a fake Redis replication request to unprotected Redis servers.
- The servers trusted the request and connected to the attacker's hidden network.
- The attacker then installed mining software to secretly use the servers' power for Monero mining.
What to do
Check if your Redis server is exposed by running redis-cli -h your-server-ip ping in a terminal. If it replies with 'PONG', your server is reachable from the internet. Next, verify your Redis version with redis-server --version. If it's 6.2.5 or older, you're affected unless you've added authentication or restricted access.
Update Redis to version 6.2.6 or later immediately. If you can't update, enable authentication by adding requirepass your-strong-password to your Redis config file and restart the service. Then check your server's CPU usage, if it spikes without reason, your server may already be mining Monero.
Technical details
Attackers sent a fake Redis replication request to unprotected Redis servers. The servers trusted the request and connected to the attacker's hidden network. The attacker then installed mining software to secretly use the servers' power for Monero mining.
A Redis cryptomining botnet used a rogue replication attack to hijack 3,562 servers for Monero mining. See how the campaign worked.